# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.168
country_id: 1269750
description:
Jan 23 04:51:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.218
country_id: 1269750
description:
Jan 23 04:51:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.92.174.85
country_id: 1643084
description:
Jan 23 04:52:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.92.174.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 23 04:52:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.238.119
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-53.108.165.238.119||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/img/photos/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.236.40.112
country_id: 783754
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/unindentedCollections.yml HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.232.47.25
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=58871515547907 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.77.14
country_id: 3996063
description:
Jan 23 05:00:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.77.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.77.14
country_id: 3996063
description:
Jan 23 05:01:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.77.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.244.65.235
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=934392 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.248
country_id: 2635167
description:
Jan 23 05:00:59 sv3 pure-ftpd[1108485]: (?@87.236.176.248) [INFO] New connection from 87.236.176.248


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.96
country_id: 3175395
description:
Jan 23 05:03:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.202
country_id: 3175395
description:
Jan 23 05:03:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.229
country_id: 690791
description:
Jan 23 05:03:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 178.172.246.221
country_id: 630336
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/anaconda/dnf.librepo.log||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.229
country_id: 690791
description:
Jan 23 05:04:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/survey-meter.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.47
country_id: 3469034
description:
Jan 23 05:08:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.250
country_id: 3175395
description:
Jan 23 05:08:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.47
country_id: 3469034
description:
Jan 23 05:08:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.171
country_id: 953987
description:
Jan 23 05:09:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jan 23 05:16:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-01-23 05:16:30 dovecot_login authenticator failed for H=([78.186.54.65]) [78.186.54.65]:47902: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.135.189.36
country_id: 660013
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/our-products/valves/valves-m1301-hot-tapping-sleeve.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.12.230
country_id: 2300660
description:
Jan 23 05:18:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.12.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.12.230
country_id: 2300660
description:
Jan 23 05:19:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.12.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.220.193
country_id: 3469034
description:
Jan 23 05:20:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.220.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.229
country_id: 953987
description:
Jan 23 05:20:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.13.47
country_id: 1819730
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/about.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 23 05:27:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-23 05:27:54 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:48718: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:28:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:28:56 dovecot_login authenticator failed for H=(9Idi4DG) [178.16.54.22]:53554: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:29:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.1.252.234
country_id: 798544
description:
Jan 23 05:29:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.1.252.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:29:24 dovecot_login authenticator failed for H=(Aw8ohNT2) [178.16.54.22]:52712: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:30:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:30:52 dovecot_login authenticator failed for H=(rQdIFy) [178.16.54.22]:58617: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:31:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:31:25 dovecot_login authenticator failed for H=(JDRP76eSet) [178.16.54.22]:58457: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:32:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:32:30 dovecot_login authenticator failed for H=(InlXXqhiC) [178.16.54.22]:64401: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.177.99
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=47581515570593 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:33:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:33:36 dovecot_login authenticator failed for H=(aofQfeK) [178.16.54.22]:50450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:34:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:34:09 dovecot_login authenticator failed for H=(zbQsYC) [178.16.54.22]:49800: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.98
country_id: 3469034
description:
Jan 23 05:35:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:36:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.98
country_id: 3469034
description:
Jan 23 05:36:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:36:16 dovecot_login authenticator failed for H=(fwoMZvWcl) [178.16.54.22]:60258: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.185
country_id: 3469034
description:
Jan 23 05:36:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:38:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:38:14 dovecot_login authenticator failed for H=(cvQ4s9) [178.16.54.22]:63197: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:39:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:39:45 dovecot_login authenticator failed for H=(KUW04L) [178.16.54.22]:50675: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:40:20 dovecot_login authenticator failed for H=(kTWIPRGt) [178.16.54.22]:50540: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:40:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.16
country_id: 3469034
description:
Jan 23 05:40:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.113.114.67
country_id: 1269750
description:
Jan 23 05:41:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.113.114.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.133.157
country_id: 3865483
description:
Jan 23 05:40:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.133.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.239.145.75
country_id: 798544
description:
Jan 23 05:41:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.239.145.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 23 05:41:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-23 05:41:26 dovecot_login authenticator failed for H=(WPeBFOlE) [178.16.54.22]:56750: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.45.167.100
country_id: 2510769
description:
Jan 23 05:42:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.45.167.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.154.194
country_id: 1269750
description:
Jan 23 05:42:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.154.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.154.194
country_id: 1269750
description:
Jan 23 05:42:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.154.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.142
country_id: 3175395
description:
Jan 23 05:44:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.160
country_id: 1269750
description:
Jan 23 05:44:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.159
country_id: 3865483
description:
Jan 23 05:44:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.186.239
country_id: 2510769
description:
Jan 23 05:44:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.183.186.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.190.93
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=509827 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.84.63.117
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/league/flysystem/docs/adapter/rackspace.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.250.139
country_id: 2395170
description:
Jan 23 05:54:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.250.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.56
country_id: 798544
description:
Jan 23 05:58:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.205.253
country_id: 3469034
description:
Jan 23 05:58:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.205.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.205
country_id: 2395170
description:
Jan 23 06:00:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.0.183
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12331520649029 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.73.83
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-08.92.71.73.83||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.152.216
country_id: 1562822
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/about.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.185.168.95
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/ResponseListener.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 23 06:12:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-23 06:12:38 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:55563: 535 Incorrect authentication data (set_id=m01)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.104
country_id: 1269750
description:
Jan 23 06:13:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-01-23 06:13:59 dovecot_login authenticator failed for H=([122.187.230.104]) [122.187.230.104]:45218: 535 Incorrect authentication data (set_id=autoreply@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.201
country_id: 3469034
description:
Jan 23 06:14:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.210
country_id: 3469034
description:
Jan 23 06:16:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.105.141.233
country_id: 798544
description:
Jan 23 06:16:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.105.141.233 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.21.196.33
country_id: 719819
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=19751516693480 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.84.233
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=414001 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 205.164.57.83
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-18.205.164.57.83||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 06:18:13 H=([64.89.160.15]) [64.89.160.15]:51226 F=<drdavid000908@outlook.com> rejected RCPT <euratech@euratech.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 06:19:32 H=([64.89.160.15]) [64.89.160.15]:58991 F=<drdavid000908@outlook.com> rejected RCPT <mkmadmin@mkmetal.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 06:22:04 H=([64.89.160.15]) [64.89.160.15]:59019 F=<essential@mailling.uk> rejected RCPT <euratech@euratech.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.113.27
country_id: 1835841
description:
Jan 23 06:22:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.253
country_id: 1269750
description:
Jan 23 06:22:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2026-01-23 06:23:50 dovecot_login authenticator failed for H=([60.8.73.174]) [60.8.73.174]:16508: 535 Incorrect authentication data (set_id=autoreply)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
country_id: 1814991
description:
Jan 23 06:23:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2026-01-23 06:23:22 dovecot_login authenticator failed for H=([111.61.177.2]) [111.61.177.2]:23256: 535 Incorrect authentication data (set_id=autoreply@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 06:23:27 H=([64.89.160.15]) [64.89.160.15]:63714 F=<essential@mailling.uk> rejected RCPT <mkmadmin@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.66.214.34
country_id: 1269750
description:
Jan 23 06:23:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.66.214.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-23 06:23:36 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:46276: 535 Incorrect authentication data (set_id=autoreply@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.12.208
country_id: 1819730
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/our-services/icon-our-services-supply_blue.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
country_id: 1814991
description:
Jan 23 06:23:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
country_id: 1835841
description:
Jan 23 06:24:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-23 06:24:07 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:43755: 535 Incorrect authentication data (set_id=autoreply)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.41
country_id: 6252001
description:
2026-01-23  6:25:33 569791 [Warning] Aborted connection 569791 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.41' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.111.223.51
country_id: 2635167
description:
Jan 23 06:27:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.111.223.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2026-01-23 06:27:08 dovecot_login authenticator failed for H=cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net [81.111.223.51]:34122: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.136.118
country_id: 1819730
description:
2026-01-23 06:28:55 dovecot_login authenticator failed for H=14-0-136-118.static.pccw-hkt.com [14.0.136.118]:45908: 535 Incorrect authentication data (set_id=autoreply)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
country_id: 1835841
description:
Jan 23 06:28:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 123.56.18.251
country_id: 1814991
description:
[2026-01-23 06:28:12 +0800] info [cpaneld] 123.56.18.251 - cofreth "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.52.54
country_id: 3469034
description:
2026-01-23 06:28:27 dovecot_login authenticator failed for H=(201-91-74-17.customer.tdatabrasil.net.br) [201.63.52.54]:50449: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.0.136.118
country_id: 1819730
description:
Jan 23 06:28:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.0.136.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-23 06:28:07 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:42021: 535 Incorrect authentication data (set_id=autoreply@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.52.54
country_id: 3469034
description:
Jan 23 06:28:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.52.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.81.250
country_id: 1269750
description:
Jan 23 06:29:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.81.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.235
country_id: 690791
description:
Jan 23 06:29:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.121.71
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-knowledge.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.7
country_id: 953987
description:
Jan 23 06:35:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.77.69
country_id: 2802361
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-36.166.0.77.69||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.7
country_id: 953987
description:
Jan 23 06:35:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.235.25
country_id: 2921044
description:
Jan 23 06:36:18 sv3 pure-ftpd[1168277]: (?@134.209.235.25) [INFO] New connection from 134.209.235.25


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.111.225.37
country_id: 3895114
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/cp.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.71
country_id: 3175395
description:
Jan 23 06:38:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.156
country_id: 3865483
description:
Jan 23 06:38:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.64.140
country_id: 1269750
description:
Jan 23 06:38:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.64.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.64.140
country_id: 1269750
description:
Jan 23 06:39:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.64.140 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.157
country_id: 2750405
description:
2026-01-23  6:46:30 570474 [Warning] Aborted connection 570474 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.157' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.157
country_id: 2750405
description:
2026-01-23  6:49:11 570563 [Warning] Aborted connection 570563 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.157' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.157
country_id: 2750405
description:
2026-01-23  6:50:30 570602 [Warning] Aborted connection 570602 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.157' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.2
country_id: 953987
description:
Jan 23 06:51:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.2
country_id: 953987
description:
Jan 23 06:51:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.140.187
country_id: 3175395
description:
Jan 23 06:52:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.140.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.215
country_id: 3175395
description:
Jan 23 06:52:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.123.24
country_id: 3865483
description:
Jan 23 06:54:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.123.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.132.153
country_id: 1269750
description:
Jan 23 06:55:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.132.153 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.115.217.155
country_id: 2782113
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/finder/Iterator/RecursiveDirectoryIterator.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.127
country_id: 6252001
description:
2026-01-23  6:56:05 570777 [Warning] Aborted connection 570777 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.127' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.151
country_id: 953987
description:
Jan 23 06:59:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.156.199
country_id: 690791
description:
Jan 23 06:59:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.156.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.122
country_id: 3469034
description:
Jan 23 06:58:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.66.150.83
country_id: 3932488
description:
2026-01-23 06:59:03 H=([127.0.1.1]) [181.66.150.83]:17354 F=<info-empresa684@infovia.com.ar> rejected RCPT <info@aire-fresh.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.252
country_id: 3469034
description:
Jan 23 07:00:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.63
country_id: 953987
description:
Jan 23 07:00:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.240
country_id: 298795
description:
Jan 23 07:00:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.156.199
country_id: 690791
description:
Jan 23 07:00:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.156.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.151
country_id: 953987
description:
Jan 23 07:00:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.240
country_id: 298795
description:
Jan 23 07:00:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.50
country_id: 798544
description:
Jan 23 07:01:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.129
country_id: 3175395
description:
Jan 23 07:01:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.137
country_id: 3469034
description:
Jan 23 07:04:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.89
country_id: 798544
description:
Jan 23 07:04:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.60.226.153
country_id: 3439705
domain: www.gagasanteguh.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.gagasanteguh.com.my/laboratory-testing.shtml HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.68.131
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-10.89.124.68.131||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.6
country_id: 3469034
description:
Jan 23 07:10:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.27.208
country_id: 798544
description:
Jan 23 07:10:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.27.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.135.253
country_id: 6290252
description:
Jan 23 07:11:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.135.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.7.242.128
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/imunify360-webshield/ssl_ports.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.41.72
country_id: 3469034
description:
Jan 23 07:11:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.41.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.188
country_id: 3865483
description:
Jan 23 07:11:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.221.244.34
country_id: 1814991
description:
Jan 23 07:11:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.221.244.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.221.244.34
country_id: 1814991
description:
2026-01-23 07:11:08 dovecot_login authenticator failed for H=([58.221.244.34]) [58.221.244.34]:43453: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
country_id: 1835841
description:
Jan 23 07:12:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2026-01-23 07:12:54 dovecot_login authenticator failed for H=([121.189.226.81]) [121.189.226.81]:47368: 535 Incorrect authentication data (set_id=jobs@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.15.37.179
country_id: 6252001
description:
2026-01-23 07:15:18 dovecot_login authenticator failed for H=pool-100-15-37-179.washdc.fios.verizon.net ([127.0.0.1]) [100.15.37.179]:60020: 535 Incorrect authentication data (set_id=info@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.169.149
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=40841526631434 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.58
country_id: 3469034
description:
Jan 23 07:18:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.197
country_id: 2510769
description:
Jan 23 07:18:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.14.155
country_id: 1819730
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/img/photos/5835562825.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.179.128.72
country_id: 2464461
description:
[2026-01-23 07:21:40 +0800] info [cpaneld] 196.179.128.72 - afcmalaysia "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.158.210
country_id: 1733045
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/our-services/icon-our-services-fabricating_blue.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.101.122
country_id: 3469034
description:
Jan 23 07:25:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.101.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.115
country_id: 3469034
description:
Jan 23 07:25:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.115
country_id: 3469034
description:
Jan 23 07:25:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.182.148.54
country_id: 3658394
description:
Jan 23 07:27:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.182.148.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-01-23 07:27:27 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:58044: 535 Incorrect authentication data (set_id=jobs@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.151
country_id: 798544
description:
Jan 23 07:27:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.160.166.161
country_id: 1835841
description:
Jan 23 07:27:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.160.166.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.233
country_id: 3175395
description:
Jan 23 07:29:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.253.10
country_id: 3865483
description:
Jan 23 07:30:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.253.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.90.251
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=39851514857984 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.220.41.70
country_id: 99237
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/65-google-droid-sans-fonts.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.122
country_id: 226074
description:
Jan 23 07:32:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.122
country_id: 226074
description:
Jan 23 07:33:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.123.107
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=58 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.94.218.20
country_id: 690791
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/mssa/index.php/activities/prize-award-ceremony-mssacidb-open-ideas-competition-for-students-2017/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 170.199.229.204
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-37.170.199.229.204||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.1.217.201
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=29 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.71.218
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=192351 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.173
country_id: 953987
description:
Jan 23 07:41:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.144
country_id: 3175395
description:
Jan 23 07:41:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.64.53
country_id: 3469034
description:
Jan 23 07:46:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.64.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.64.53
country_id: 3469034
description:
Jan 23 07:47:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.64.53 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/m.me/images/home/article.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.17
country_id: 798544
description:
Jan 23 07:47:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.88
country_id: 3469034
description:
Jan 23 07:47:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.88
country_id: 3469034
description:
Jan 23 07:48:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.21.44.66
country_id: 6252001
description:
2026-01-23 07:49:13 dovecot_login authenticator failed for H=174-21-44-66.tukw.qwest.net ([127.0.0.1]) [174.21.44.66]:50220: 535 Incorrect authentication data (set_id=info@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.89.213.67
country_id: 3469034
description:
Jan 23 07:52:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.89.213.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-23 07:53:14 H=([62.60.130.227]) [62.60.130.227]:60120 F=<shipment-tracking@amazon.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from amazon.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.119
country_id: 2300660
description:
Jan 23 07:54:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.136.215
country_id: 3175395
description:
Jan 23 07:54:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.136.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.188.212.17
country_id: 2510769
description:
Jan 23 07:54:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.188.212.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.170
country_id: 3469034
description:
Jan 23 07:54:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.186
country_id: 3175395
description:
Jan 23 07:54:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.86.174
country_id: 2328926
description:
Jan 23 07:54:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.86.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.76.123
country_id: 3469034
description:
Jan 23 07:56:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.76.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.68.34
country_id: 1269750
description:
Jan 23 07:56:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.225.68.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.142.255.122
country_id: 1643084
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/index.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.197.15
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=47721516585601 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.53
country_id: 719819
description:
Jan 23 08:02:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.53
country_id: 719819
description:
Jan 23 08:03:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.29
country_id: 3469034
description:
Jan 23 08:03:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.31
country_id: 3469034
description:
Jan 23 08:04:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.127.40.150
country_id: 3469034
description:
Jan 23 08:04:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.127.40.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.204
country_id: 953987
description:
Jan 23 08:04:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.218
country_id: 953987
description:
Jan 23 08:04:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.102.207
country_id: 798544
description:
Jan 23 08:05:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.102.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-23 08:06:00 +0800] info [cpaneld] 165.22.212.32 - cofreth "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.253
country_id: 3175395
description:
Jan 23 08:07:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.127.249.46
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=29121522746589 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.253
country_id: 3175395
description:
Jan 23 08:07:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.131.71.52
country_id: 1562822
domain: www.feliogroup.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/https:/www.the3rdeye.com.my/home/therdeye/public_html/www.feliogroup.com||User:feliogroupcom||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 210.149.115.33
country_id: 1861060
domain: agsaintifik.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:210.149.115.33||TA:210.149.115.33||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.103
country_id: 1269750
description:
Jan 23 08:12:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.75
country_id: 2510769
description:
Jan 23 08:12:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.30.236
country_id: 798544
description:
Jan 23 08:13:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.94.30.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.219.201.67
country_id: 953987
description:
Jan 23 08:14:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.219.201.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.28.247.80
country_id: 290557
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/Thumb_790x600-16.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.94.212
country_id: 3469034
description:
Jan 23 08:21:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.94.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.199
country_id: 3469034
description:
Jan 23 08:21:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.230.4
country_id: 3865483
description:
Jan 23 08:22:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.230.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.73.17
country_id: 3469034
description:
Jan 23 08:22:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.73.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.104.184
country_id: 3469034
description:
Jan 23 08:23:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.104.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.0.105.88
country_id: 2510769
description:
Jan 23 08:23:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.0.105.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.73.17
country_id: 3469034
description:
Jan 23 08:23:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.73.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.58
country_id: 1269750
description:
Jan 23 08:23:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.79.179
country_id: 3865483
description:
Jan 23 08:24:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.79.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 08:24:58 +0800] info [webmaild] 180.75.72.60 - - "GET /apple-touch-icon.png HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2026-01-23 08:24:52 dovecot_login authenticator failed for H=(pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:47784: 535 Incorrect authentication data (set_id=billing@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-23 08:24:19 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:50247: 535 Incorrect authentication data (set_id=billing@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.196.85
country_id: 1819730
description:
Jan 23 08:27:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.196.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.85
country_id: 1819730
description:
2026-01-23 08:27:21 dovecot_login authenticator failed for H=(223-197-196-85.static.imsbiz.com) [223.197.196.85]:50556: 535 Incorrect authentication data (set_id=billing@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.246.59.178
country_id: 3865483
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/dreamland2.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.141.120.97
country_id: 3703430
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/swiftmailer/swiftmailer/doc/messages.rst HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 08:30:31 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 08:30:38 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.250.114.241
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=878467 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-23 08:30:28 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:41233: 535 Incorrect authentication data (set_id=billing@mckd.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 08:31:08 +0800] info [webmaild] 203.106.96.63 - infocal@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.13.108
country_id: 3469034
description:
Jan 23 08:34:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.13.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.17
country_id: 3469034
description:
Jan 23 08:34:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.17
country_id: 3469034
description:
Jan 23 08:34:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.13.108
country_id: 3469034
description:
Jan 23 08:34:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.13.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.172
country_id: 3469034
description:
Jan 23 08:35:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.213
country_id: 3469034
description:
Jan 23 08:35:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.76
country_id: 953987
description:
Jan 23 08:35:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.65
country_id: 690791
description:
Jan 23 08:36:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.89.249.3
country_id: 2635167
description:
Jan 23 08:36:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.89.249.3 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.78.183.19
country_id: 2802361
description:
2026-01-23  8:37:10 574226 [Warning] Aborted connection 574226 to db: 'unconnected' user: 'unauthenticated' host: '34.78.183.19' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.100.109
country_id: 1562822
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=264485 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/testimonial.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.75.135
country_id: 3469034
description:
Jan 23 08:40:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.75.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.161
country_id: 953987
description:
Jan 23 08:40:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.40
country_id: 798544
description:
Jan 23 08:41:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.38.117
country_id: 798544
description:
Jan 23 08:42:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.38.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.127.117.14
country_id: 3437598
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=99251516783992 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.228
country_id: 953987
description:
Jan 23 08:43:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.231
country_id: 2510769
description:
Jan 23 08:43:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.23
country_id: 953987
description:
Jan 23 08:43:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.23 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.123.165
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=68&page=8 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.160.70
country_id: 3469034
description:
Jan 23 08:43:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.23
country_id: 953987
description:
Jan 23 08:44:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.23 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.125
country_id: 617790
domain: maalloys.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X41; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/197.0.5304.110 Safari/527.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 08:54:32 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.136
country_id: 953987
description:
Jan 23 08:55:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.136
country_id: 953987
description:
Jan 23 08:56:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 08:56:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57522: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 88.241.94.218
country_id: 298795
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/61-urw-nimbus-roman.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.125
country_id: 3175395
description:
Jan 23 08:56:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 08:57:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51636: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.184.180.205
country_id: 3469034
description:
Jan 23 08:58:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.184.180.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.85
country_id: 3469034
description:
Jan 23 08:58:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 08:59:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51690: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.56.66
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-59.196.51.56.66||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.61.127.44
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-00.45.61.127.44||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.220
country_id: 3865483
description:
Jan 23 09:00:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.142
country_id: 732800
description:
Jan 23 09:02:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.221
country_id: 3469034
description:
Jan 23 09:02:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.145.206
country_id: 3469034
description:
Jan 23 09:02:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.145.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.145.206
country_id: 3469034
description:
Jan 23 09:03:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.145.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 09:03:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56430: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.176
country_id: 2300660
description:
Jan 23 09:03:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.69
country_id: 3469034
description:
Jan 23 09:03:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.186.239.107
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=18 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 143.244.152.105
country_id: 6252001
description:
Jan 23 09:10:15 sv3 pure-ftpd[1297171]: (?@143.244.152.105) [INFO] New connection from 143.244.152.105


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.230
country_id: 6252001
description:
2026-01-23  9:10:57 575430 [Warning] Aborted connection 575430 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.230' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 09:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49875: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.231
country_id: 3865483
description:
Jan 23 09:13:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.147
country_id: 3469034
description:
Jan 23 09:13:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.196.87
country_id: 798544
description:
Jan 23 09:14:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.196.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.147
country_id: 3469034
description:
Jan 23 09:13:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.78.70
country_id: 3686110
description:
Jan 23 09:14:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.78.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.80
country_id: 3469034
description:
Jan 23 09:16:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.226.32.85
country_id: 3865483
description:
Jan 23 09:16:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.226.32.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.129.255.180
country_id: 3469034
description:
Jan 23 09:17:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.129.255.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 09:18:58 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 09:19:02 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 09:20:01 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Jan 23 09:23:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.182
country_id: 1668284
description:
Jan 23 09:23:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
country_id: 1668284
description:
2026-01-23 09:23:43 dovecot_login authenticator failed for H=111-70-49-182.emome-ip.hinet.net [111.70.49.182]:34994: 535 Incorrect authentication data (set_id=autoreply@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 09:23:47 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60648: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 09:23:59 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60649: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.253
country_id: 1269750
description:
Jan 23 09:24:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.59.60.96
country_id: 597427
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/career.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.213.91.4
country_id: 1819730
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/img/photos/1103401881.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 09:27:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60710: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 09:27:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52564: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.218
country_id: 1269750
description:
Jan 23 09:28:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.33.79
country_id: 1819730
description:
Jan 23 09:28:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.33.79 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.119.112.132
country_id: 6252001
description:
Jan 23 09:28:48 sv3 pure-ftpd[1329086]: (?@135.119.112.132) [INFO] New connection from 135.119.112.132


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.240
country_id: 1269750
description:
Jan 23 09:29:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 09:29:54 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60753: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.97.108
country_id: 1814991
description:
Jan 23 09:30:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.97.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2026-01-23 09:30:36 dovecot_login authenticator failed for H=([111.61.97.108]) [111.61.97.108]:28414: 535 Incorrect authentication data (set_id=autoreply@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 09:30:00 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60753: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.251
country_id: 3469034
description:
Jan 23 09:31:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 09:32:44 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60831: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 09:33:02 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60832: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.165.106.66
country_id: 1269750
description:
Jan 23 09:36:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.165.106.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.25.11
country_id: 6252001
description:
2026-01-23 09:36:13 dovecot_plain authenticator failed for H=([10.50.18.192]) [158.173.25.11]:46944: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.43.112.160
country_id: 3865483
description:
[2026-01-23 09:37:01 +0800] info [cpaneld] 179.43.112.160 - agpcorgm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpcorgm (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.65.33.140
country_id: 6252001
description:
2026-01-23  9:38:58 577032 [Warning] Aborted connection 577032 to db: 'unconnected' user: 'unauthenticated' host: '159.65.33.140' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.233.35.138
country_id: 3469034
domain: www.ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ds-staffing.com/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/home/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.54.0.203
country_id: 3686110
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/carsdrifthowtogetthere.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 09:43:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60857: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.225.116
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:09-44.216.26.225.116||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.213.166.60
country_id: 2921044
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:09-44.154.213.166.60||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.41.41
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:09-44.104.207.41.41||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.54.223
country_id: 2635167
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:09-44.45.3.54.223||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.28
country_id: 3175395
description:
Jan 23 09:46:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.128
country_id: 3175395
description:
Jan 23 09:47:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.144
country_id: 3175395
description:
Jan 23 09:47:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.32
country_id: 3175395
description:
Jan 23 09:47:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.128
country_id: 3175395
description:
Jan 23 09:48:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.32
country_id: 3175395
description:
Jan 23 09:48:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.105.202.253
country_id: 102358
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=541552 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.1.246
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=67&page=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 09:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52905: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/radioactive.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 23 09:56:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.78.22.210
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news-more.php?id=608309 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.185.255.227
country_id: 1814991
description:
Jan 23 09:56:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.185.255.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.125.239
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/facilities.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.77.195
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/listing.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.43.224
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=732059 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 09:58:26 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.151
country_id: 2300660
description:
Jan 23 09:59:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.151
country_id: 2300660
description:
Jan 23 10:00:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-23 10:00:05 H=([127.0.0.1]) [103.197.57.71]:60656 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.141.242
country_id: 99237
description:
Jan 23 10:00:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.141.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13009
name: Multiple triggers of Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-23 10:00:46 H=([127.0.0.1]) [103.197.57.71]:34074 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 10:01:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60871: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 10:01:09 H=([64.89.160.15]) [64.89.160.15]:49813 F=<drdavid000908@outlook.com> rejected RCPT <chuan@tschuan.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.111
country_id: 798544
description:
Jan 23 10:01:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-23 10:02:17 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:52922: 535 Incorrect authentication data (set_id=orders@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 10:03:37 H=([64.89.160.15]) [64.89.160.15]:65244 F=<drdavid000908@outlook.com> rejected RCPT <ind@indfinitydesign.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.43.59
country_id: 3469034
description:
Jan 23 10:06:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.43.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.63
country_id: 1269750
description:
Jan 23 10:10:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 10:10:56 H=([64.89.160.15]) [64.89.160.15]:49773 F=<essential@mailling.uk> rejected RCPT <chuan@tschuan.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.63
country_id: 953987
description:
Jan 23 10:10:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.63 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 10:11:45 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 23 10:13:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-23 10:13:03 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:52066: 535 Incorrect authentication data (set_id=af)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-23 10:13:12 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:45199: 535 Incorrect authentication data (set_id=orders@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 10:13:16 H=([64.89.160.15]) [64.89.160.15]:57156 F=<essential@mailling.uk> rejected RCPT <ind@indfinitydesign.com>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 207.166.178.205
country_id: 1880251
domain: figofoods.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/webdesign.monkeymedia2u.com||User:cabecom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.0.250.125
country_id: 3469034
description:
Jan 23 10:15:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.0.250.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-23 10:15:51 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:58031: 535 Incorrect authentication data (set_id=orders@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.135
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-17.92.71.72.135||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.147
country_id: 3175395
description:
Jan 23 10:17:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.26
country_id: 798544
description:
Jan 23 10:20:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-23 10:20:24 +0800] info [webmaild] 175.136.123.47 - roz@af-sb.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 10:21:53 +0800] info [webmaild] 203.106.96.63 - info@sutsb.com.my "GET /cpsess7988926389/3rdparty/roundcube/?_task=logout&_token=dkzr09TQxF8Sbgk70NEuFCoVO50fjOlx HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 10:23:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56098: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.78
country_id: 3175395
description:
Jan 23 10:27:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 10:31:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60891: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.33.153
country_id: 3865483
description:
Jan 23 10:31:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.33.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.107
country_id: 3996063
description:
Jan 23 10:31:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.121.156
country_id: 3865483
description:
Jan 23 10:31:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.121.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.107
country_id: 3996063
description:
Jan 23 10:32:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.219
country_id: 2510769
description:
Jan 23 10:33:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.164
country_id: 3469034
description:
Jan 23 10:34:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.12.32
country_id: 798544
description:
Jan 23 10:36:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.12.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 147.53.118.16
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-36.147.53.118.16||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.120
country_id: 3996063
description:
Jan 23 10:37:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.120 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/images/home/article.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 118.100.253.169
country_id: 1733045
description:
[2026-01-23 10:37:18 +0800] info [webmaild] 118.100.253.169 - khadijah@euratech.com.my "POST /cpsess4926804803/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [118.100.95.65] != Current IP Address [118.100.253.169]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.30.194
country_id: 226074
description:
Jan 23 10:37:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.30.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.46
country_id: 3469034
description:
Jan 23 10:38:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.30.194
country_id: 226074
description:
Jan 23 10:38:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.30.194 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.182
country_id: 6252001
description:
Jan 23 10:39:41 sv3 pure-ftpd[1452114]: (?@167.94.138.182) [INFO] New connection from 167.94.138.182


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 10:40:41 +0800] info [webmaild] 203.106.96.63 - sales@sutsb.com.my "POST /cpsess5328692118/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 10:41:41 +0800] info [webmaild] 203.106.96.63 - sales@sutsb.com.my "POST /cpsess5328692118/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.66
country_id: 1269750
description:
Jan 23 10:42:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 10:42:41 +0800] info [webmaild] 203.106.96.63 - sales@sutsb.com.my "POST /cpsess5328692118/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.42
country_id: 798544
description:
Jan 23 10:43:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 99.19.72.69
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-43.99.19.72.69||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.3
country_id: 2750405
description:
2026-01-23 10:48:45 H=([46.151.182.3]) [46.151.182.3]:53273 F=<chuan@tschuan.com> rejected RCPT <chuan@tschuan.com>: SPF: 46.151.182.3 is not allowed to send mail from tschuan.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.251
country_id: 3469034
description:
Jan 23 10:48:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.78
country_id: 3469034
description:
Jan 23 10:49:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.238.240
country_id: 1562822
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/ourproducts.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.251
country_id: 3469034
description:
Jan 23 10:49:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-23 10:50:41 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.52
country_id: 690791
description:
2026-01-23 10:50:47 H=([45.144.212.52]) [45.144.212.52]:62810 F=<ops@gearbulkshipping.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.52 is not allowed to send mail from gearbulkshipping.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 10:51:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56371: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-23 10:51:35 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess0856630531/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.56.155
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14641514945247 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.163.10.29
country_id: 1861060
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/img/photos/6703432854.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.106.80.94
country_id: 3469034
description:
Jan 23 10:58:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.106.80.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.106.80.94
country_id: 3469034
description:
Jan 23 10:59:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.106.80.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 10:59:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60921: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.65
country_id: 798544
description:
Jan 23 10:59:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.18
country_id: 798544
description:
Jan 23 11:00:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.94
country_id: 953987
description:
Jan 23 11:00:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.18
country_id: 798544
description:
Jan 23 11:01:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/component/tag/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.161.33.105
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=37261514885943 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.138.245.58
country_id: 1733045
description:
[2026-01-23 11:05:59 +0800] info [webmaild] 175.138.245.58 - mag@symphony-led.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 11:06:41 +0800] info [webmaild] 203.106.96.63 - infolab@sutsb.com.my "POST /cpsess4810515438/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-23 11:11:22 H=([45.144.212.41]) [45.144.212.41]:60114 F=<powerbiz@emirates.net.ae> rejected RCPT <cklee@ktlog.com.my>: SPF: 45.144.212.41 is not allowed to send mail from emirates.net.ae


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.151.227
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=526641 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.109.166.254
country_id: 3469034
description:
Jan 23 11:13:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.109.166.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.189
country_id: 3865483
description:
Jan 23 11:13:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.252.210.233
country_id: 6252001
domain: cordage.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-14.192.252.210.233||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.189
country_id: 3865483
description:
Jan 23 11:14:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.16
country_id: 953987
description:
Jan 23 11:17:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 11:19:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56594: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 11:21:18 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 172.224.240.16
country_id: 1733045
description:
[2026-01-23 11:21:44 +0800] info [webmaild] 172.224.240.16 - ismail@ajplantations.com.my "GET /cpsess1969275505/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.135.198
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=36 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.13.211.92
country_id: 3865483
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/awards.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 11:27:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60953: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.177
country_id: 3175395
description:
Jan 23 11:31:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.250.152
country_id: 3469034
description:
Jan 23 11:34:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.250.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.55
country_id: 1269750
description:
Jan 23 11:34:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.104.190
country_id: 3469034
description:
Jan 23 11:35:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.104.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.55
country_id: 1269750
description:
Jan 23 11:35:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.189
country_id: 1269750
description:
Jan 23 11:36:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/photos/article.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.152.235
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=649112 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.72
country_id: 3865483
description:
Jan 23 11:37:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.161.55.217
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/league/flysystem/CODE_OF_CONDUCT.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.232.209.149
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-42.104.232.209.149||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.190.96.234
country_id: 3469034
description:
Jan 23 11:45:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.190.96.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.190.96.234
country_id: 3469034
description:
Jan 23 11:46:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.190.96.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.111
country_id: 3469034
description:
Jan 23 11:46:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.154.138
country_id: 6252001
description:
Jan 23 11:46:40 sv3 pure-ftpd[1567239]: (?@199.45.154.138) [INFO] New connection from 199.45.154.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 11:47:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58586: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.245
country_id: 3469034
description:
Jan 23 11:47:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.245 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.196.66.27
country_id: 798549
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=40 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.111
country_id: 6252001
description:
2026-01-23 11:51:31 584023 [Warning] Aborted connection 584023 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.111' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.172.238.227
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-23 11:52:10 H=([45.144.212.50]) [45.144.212.50]:63090 F=<advising.service@advising.hsbc.com> rejected RCPT <astklia@astlog.com.my>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 11:55:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60983: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.219.158.41
country_id: 3703430
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/VerificationDirector.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-23 11:55:17 H=([10.1.1.140]) [60.54.167.90]:49231 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-23 11:56:03 H=([10.1.1.140]) [60.54.167.90]:49255 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.210
country_id: 6290252
description:
Jan 23 11:56:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.83
country_id: 3865483
description:
Jan 23 12:01:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.83 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.181.247.156
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Exception/ConflictingHeadersException.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.243
country_id: 2300660
description:
Jan 23 12:05:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-23 12:07:45 H=([45.144.212.41]) [45.144.212.41]:61345 F=<powerbiz@emirates.net.ae> rejected RCPT <shipping@cordage.com.my>: SPF: 45.144.212.41 is not allowed to send mail from emirates.net.ae


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-23 12:09:19 H=([10.1.1.140]) [60.54.167.90]:49413 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.143.0.46
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38431515379390 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.197
country_id: 1269750
description:
Jan 23 12:14:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jan 23 12:14:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 12:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64120: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.41.44.88
country_id: 1168579
domain: acburn.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:91871.acburn.com.my||ServerName:acburn.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:16bc3f21bb026dcc2248ff1ce36fa9fbe45139f9||Title:0x5b96aab3||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.142.44.154
country_id: 1814991
description:
2026-01-23 12:17:57 dovecot_login authenticator failed for H=([211.142.44.154]) [211.142.44.154]:34596: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
country_id: 1605651
description:
Jan 23 12:17:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-23 12:17:39 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:36462: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.142.44.154
country_id: 1814991
description:
Jan 23 12:17:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.142.44.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-23 12:20:13 H=([10.1.1.165]) [60.54.167.90]:49453 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.39
country_id: 3469034
description:
Jan 23 12:21:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.39 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-23 12:21:41 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1903874427/3rdparty/roundcube/?_task=mail&_mbox=INBOX.spam HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.82.133.73
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=827315 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.187
country_id: 1269750
description:
Jan 23 12:23:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-01-23 12:23:55 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:41317: 535 Incorrect authentication data (set_id=autoreply@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 12:23:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61019: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.0.255.8
country_id: 3573591
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=99681514874217 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.155
country_id: 732800
description:
Jan 23 12:27:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.74
country_id: 226074
description:
Jan 23 12:30:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.78
country_id: 3469034
description:
Jan 23 12:30:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.78
country_id: 3469034
description:
Jan 23 12:30:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.74
country_id: 226074
description:
Jan 23 12:31:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 12:31:21 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.98.65
country_id: 3469034
description:
Jan 23 12:33:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.98.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.98.65
country_id: 3469034
description:
Jan 23 12:33:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.98.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.54
country_id: 933860
description:
Jan 23 12:36:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.237
country_id: 3469034
description:
Jan 23 12:36:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.75.96
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-36.92.71.75.96||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.177.36
country_id: 298795
description:
Jan 23 12:37:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.177.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.19.87
country_id: 1819730
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack   File Box/DocQ Rack-1A Rev2-120x120.JPG HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.19.87
country_id: 1819730
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack   File Box/DocQ Rack-1A Rev2-120x120.JPG HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.119.157
country_id: 732800
description:
Jan 23 12:41:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.119.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.99
country_id: 3469034
description:
Jan 23 12:42:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.14
country_id: 2635167
description:
Jan 23 12:42:44 sv3 pure-ftpd[1653799]: (?@185.247.137.14) [INFO] New connection from 185.247.137.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 12:43:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50638: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.3.222
country_id: 1562822
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/our-products.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.49.249.39
country_id: 3175395
description:
Jan 23 12:48:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.49.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 12:51:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61050: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.219.152
country_id: 1562822
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/product.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-23 12:55:51 H=(localhost.localdomain) [78.153.140.207]:36336 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.144.131
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=900301 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.41.175.52
country_id: 798544
description:
Jan 23 12:59:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.41.175.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/career.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.65.35
country_id: 3469034
description:
Jan 23 13:05:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.252.65.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.209
country_id: 3469034
description:
Jan 23 13:05:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.65.35
country_id: 3469034
description:
Jan 23 13:06:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.252.65.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.24.202.135
country_id: 798544
description:
Jan 23 13:06:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.24.202.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.224
country_id: 3469034
description:
Jan 23 13:06:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.224 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.223.8
country_id: 1733045
description:
Jan 23 13:07:04 sv3 pure-ftpd[1687744]: (oxboldc@175.143.223.8) [NOTICE] /home/oxboldc//public_html/paragliding-studentpilotcourse.htm uploaded  (134165 bytes, 4807.41KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.123.24
country_id: 3865483
description:
Jan 23 13:08:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.123.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.123.24
country_id: 3865483
description:
Jan 23 13:09:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.123.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 13:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50749: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.5
country_id: 3175395
description:
Jan 23 13:11:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.64
country_id: 3175395
description:
Jan 23 13:11:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.3
country_id: 2750405
description:
2026-01-23 13:11:35 H=([46.151.182.3]) [46.151.182.3]:58993 F=<corporate_chaah@ajplantations.com.my> rejected RCPT <corporate_chaah@ajplantations.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.106
country_id: 798544
description:
Jan 23 13:11:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2026-01-23 13:12:23 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:57108: 535 Incorrect authentication data (set_id=security@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.50
country_id: 3175395
description:
Jan 23 13:12:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.222
country_id: 1819730
description:
Jan 23 13:12:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.222 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.225.213.229
country_id: 2464461
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/en HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.131.20
country_id: 99237
description:
Jan 23 13:13:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.131.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.50
country_id: 3175395
description:
Jan 23 13:13:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.45.29
country_id: 6290252
description:
Jan 23 13:13:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.45.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.46
country_id: 1269750
description:
Jan 23 13:13:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.9
country_id: 2395170
description:
Jan 23 13:13:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.9.94
country_id: 3996063
description:
Jan 23 13:13:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.9.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.215
country_id: 3865483
description:
Jan 23 13:13:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.189.123
country_id: 99237
description:
Jan 23 13:13:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.189.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.45.162
country_id: 226074
description:
Jan 23 13:13:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.45.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.131.20
country_id: 99237
description:
Jan 23 13:13:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.131.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.45.162
country_id: 226074
description:
Jan 23 13:13:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.45.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.32
country_id: 3469034
description:
Jan 23 13:14:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-23 13:14:38 H=([10.1.1.165]) [60.54.167.90]:49501 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.190.104.117
country_id: 6252001
description:
2026-01-23 13:15:17 dovecot_login authenticator failed for H=ip70-190-104-117.ph.ph.cox.net ([127.0.0.1]) [70.190.104.117]:38488: 535 Incorrect authentication data (set_id=info@titan-vista.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-23 13:16:37 H=([10.1.1.165]) [60.54.167.90]:49555 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 164.163.28.201
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/EnumStub.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-23 13:17:08 H=([10.1.1.165]) [60.54.167.90]:49563 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.52
country_id: 690791
description:
2026-01-23 13:18:08 H=([45.144.212.52]) [45.144.212.52]:63983 F=<INFO@coscoshipping.com> rejected RCPT <fkr@fkr.com.my>: SPF: 45.144.212.52 is not allowed to send mail from coscoshipping.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 13:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61084: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-23 13:19:16 H=([10.1.1.165]) [60.54.167.90]:49591 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.8.227
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=30 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.191.185.122
country_id: 798544
description:
Jan 23 13:23:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.191.185.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.246.213
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=680282 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.55.159.16
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Exception/RequestExceptionInterface.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.107.136.187
country_id: 690791
description:
2026-01-23 13:27:33 dovecot_plain authenticator failed for H=(matcup) [185.107.136.187]:58637: 535 Incorrect authentication data (set_id=info@symphony-led.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.107.136.187
country_id: 690791
description:
Jan 23 13:27:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.107.136.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.27.73
country_id: 798544
description:
Jan 23 13:32:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.27.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.2.46.155
country_id: 1643084
description:
Jan 23 13:33:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.2.46.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.149.92
country_id: 6252001
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/wp-content/uploads/2014/04/Selector-Switch-1P-test.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.59.132.51
country_id: 798544
description:
Jan 23 13:33:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.59.132.51 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.127.94.64
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=644279 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.2.46.155
country_id: 1643084
description:
Jan 23 13:34:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.2.46.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.15.105.47
country_id: 1269750
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/glove-dipping-line.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.210.101.132
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/jakub-onderka/php-console-highlighter/LICENSE HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 13:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55279: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.150.109.105
country_id: 6251999
description:
Jan 23 13:39:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.150.109.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.7
country_id: 690791
description:
2026-01-23 13:40:49 H=([45.144.212.7]) [45.144.212.7]:63799 F=<finance@bafcobh.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jan 23 13:41:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.151.109
country_id: 798544
description:
Jan 23 13:42:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.151.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.18
country_id: 1269750
description:
Jan 23 13:42:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.132
country_id: 6252001
description:
Jan 23 13:42:01 sv3 pure-ftpd[1728742]: (?@198.235.24.132) [INFO] New connection from 198.235.24.132


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.241.179
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-42.166.0.241.179||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.34.24
country_id: 3865483
description:
Jan 23 13:43:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.34.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.195
country_id: 3469034
description:
Jan 23 13:43:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.219.115.240
country_id: 1880251
description:
[2026-01-23 13:47:49 +0800] info [cpaneld] 8.219.115.240 - thinkclo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user thinkclo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 13:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61109: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.188.226.42
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/AcceptHeaderItemTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.68.150
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maatwebsite/excel/src/Maatwebsite/Excel/Classes HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.244.182.171
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maatwebsite/excel/src/Maatwebsite/Excel/Classes/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.143
country_id: 3175395
description:
Jan 23 13:49:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.13.113.5
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/nesbot/carbon/src/Carbon/Translator.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.118
country_id: 3469034
description:
Jan 23 13:54:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.199.179.20
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.118
country_id: 3469034
description:
Jan 23 13:55:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.88.118
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=60811516693269 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.38.254.182
country_id: 6252001
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/our-products/pipe-connections/pipe-connections-m2411-universal-mechanical-coupling.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.52
country_id: 690791
description:
2026-01-23 14:01:34 H=([45.144.212.52]) [45.144.212.52]:57015 F=<ops@gearbulkshipping.com> rejected RCPT <astkch@astlog.com.my>: SPF: 45.144.212.52 is not allowed to send mail from gearbulkshipping.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.126.228.203
country_id: 3469034
description:
Jan 23 14:01:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.126.228.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.115.171.5
country_id: 1733045
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-02.103.115.171.5||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.101
country_id: 1269750
description:
Jan 23 14:02:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.101
country_id: 1269750
description:
Jan 23 14:02:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.57
country_id: 690791
description:
Jan 23 14:03:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.166
country_id: 298795
description:
Jan 23 14:03:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.88.108
country_id: 1269750
description:
Jan 23 14:03:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.88.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.0.22
country_id: 3469034
description:
Jan 23 14:04:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.0.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.88.108
country_id: 1269750
description:
Jan 23 14:04:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.88.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.0.22
country_id: 3469034
description:
Jan 23 14:05:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.0.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.102
country_id: 3469034
description:
Jan 23 14:06:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.61
country_id: 953987
description:
Jan 23 14:06:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.143.237.253
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/listing-details.php?id=54324787 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 14:07:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56668: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.192.253.180
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=79471516669952 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 23 14:08:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-23 14:08:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62792: 535 Incorrect authentication data (set_id=wwl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.227.225.13
country_id: 3469034
description:
Jan 23 14:09:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.227.225.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.239.246
country_id: 3469034
description:
Jan 23 14:09:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.239.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.138
country_id: 3469034
description:
Jan 23 14:11:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-23 14:11:20 H=(localhost.localdomain) [78.153.140.207]:49684 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.220.111
country_id: 3469034
description:
Jan 23 14:11:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.220.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 14:13:55 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 14:13:59 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 14:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61138: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 14:15:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 14:16:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.102
country_id: 3469034
description:
Jan 23 14:17:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.186
country_id: 1269750
description:
Jan 23 14:17:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.96.117.25
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-18.191.96.117.25||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 14:18:44 H=([64.89.160.15]) [64.89.160.15]:50092 F=<drdavid000908@outlook.com> rejected RCPT <euratech@euratech.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 14:20:01 H=([64.89.160.15]) [64.89.160.15]:56866 F=<drdavid000908@outlook.com> rejected RCPT <mkmadmin@mkmetal.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 14:21:11 H=([64.89.160.15]) [64.89.160.15]:49175 F=<essential@mailling.uk> rejected RCPT <euratech@euratech.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 14:22:27 H=([64.89.160.15]) [64.89.160.15]:54850 F=<essential@mailling.uk> rejected RCPT <mkmadmin@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 14:23:50 +0800] info [webmaild] 203.106.96.63 - ehsan@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.232.126
country_id: 1269750
description:
Jan 23 14:24:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.232.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.232.126
country_id: 1269750
description:
2026-01-23 14:24:17 dovecot_login authenticator failed for H=(nsg-corporate-126.232.187.122.airtel.in) [122.187.232.126]:43172: 535 Incorrect authentication data (set_id=tech@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.244
country_id: 3865483
description:
Jan 23 14:25:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.161.177
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-28.166.0.161.177||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.247.12
country_id: 1733045
description:
[2026-01-23 14:28:54 +0800] info [webmaild] 27.125.247.12 - cmchin@chs.com.my "POST /cpsess7444451056/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.242.82] != Current IP Address [27.125.247.12]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.138
country_id: 690791
description:
Jan 23 14:28:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.124.164
country_id: 1733045
description:
[2026-01-23 14:29:16 +0800] info [webmaild] 113.211.124.164 - felicia@nexuscollection.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 14:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56800: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 14:38:31 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.89.48
country_id: 3469034
description:
Jan 23 14:39:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.89.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.89.48
country_id: 3469034
description:
Jan 23 14:40:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.89.48 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 23.239.28.113
country_id: 6252001
domain: 34.217.70.37
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.70.37/azenv.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 121.122.111.99
country_id: 1733045
domain: www.box.com.my
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:7.64||T:APACHE||MVN:ARGS:product_shipping_class||MV:-1||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.239.148.87
country_id: 3996063
description:
Jan 23 14:45:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.239.148.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.122.45
country_id: 3469034
description:
Jan 23 14:45:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.122.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.122.45
country_id: 3469034
description:
Jan 23 14:45:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.122.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.38
country_id: 3175395
description:
Jan 23 14:50:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.247.12
country_id: 1733045
description:
[2026-01-23 14:50:39 +0800] info [webmaild] 27.125.247.12 - cmchin@chs.com.my "GET /cpsess4651423257/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 14:50:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.97.131
country_id: 6290252
description:
Jan 23 14:51:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.97.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 14:51:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.38
country_id: 3175395
description:
Jan 23 14:51:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 14:52:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.97.131
country_id: 6290252
description:
Jan 23 14:51:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.97.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-23 14:54:19 H=(localhost.localdomain) [78.153.140.207]:38838 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.130
country_id: 2395170
description:
Jan 23 14:57:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 14:58:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.202.35.61
country_id: 1831722
description:
[2026-01-23 14:59:29 +0800] info [cpaneld] 160.202.35.61 - Intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 14:59:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.57.144
country_id: 1269750
description:
Jan 23 15:00:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.57.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 15:00:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.158.52
country_id: 690791
description:
Jan 23 15:03:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.158.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 15:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51250: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.7
country_id: 690791
description:
Jan 23 15:03:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 15:04:09 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.232
country_id: 2300660
description:
Jan 23 15:04:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.158.52
country_id: 690791
description:
Jan 23 15:04:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.158.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.193
country_id: 3469034
description:
Jan 23 15:06:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.172.231
country_id: 1562822
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/product-detail.php?id=933107 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.37
country_id: 3175395
description:
Jan 23 15:07:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.132.105.111
country_id: 1733045
description:
[2026-01-23 15:10:53 +0800] info [webmaild] 115.132.105.111 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mustapa@astlog.com.my [01/23/2026:07:13:38 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mustapa@astlog.com.my


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.202.35.61
country_id: 1831722
description:
[2026-01-23 15:13:52 +0800] info [cpaneld] 160.202.35.61 - Intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.166
country_id: 3175395
description:
Jan 23 15:13:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-23 15:14:03 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:38010: 535 Incorrect authentication data (set_id=careers@manforce.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 15:14:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.241.50
country_id: 1814991
description:
Jan 23 15:14:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.241.50 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@astlog.com.my [01/23/2026:07:15:16 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@astlog.com.my


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.237.79.74
country_id: 3686110
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=53591516695761 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 15:15:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 143.137.166.92
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.64||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/406/feedback||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.52
country_id: 690791
description:
2026-01-23 15:15:36 H=([45.144.212.52]) [45.144.212.52]:57837 F=<tomj@siglandscaping.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.52 is not allowed to send mail from siglandscaping.com


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 143.137.166.92
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/406/feedback||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 15:16:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.105.141.235
country_id: 798544
description:
Jan 23 15:16:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.105.141.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.105.141.235
country_id: 798544
description:
Jan 23 15:16:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.105.141.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.148
country_id: 3865483
description:
Jan 23 15:17:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.241.50
country_id: 1814991
description:
Jan 23 15:19:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.241.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-23 15:19:27 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:46512: 535 Incorrect authentication data (set_id=careers@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.34
country_id: 226074
description:
Jan 23 15:22:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.99.132
country_id: 3057568
description:
Jan 23 15:22:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.99.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.99.132
country_id: 3057568
description:
Jan 23 15:23:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.99.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 15:23:25 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61219: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.223.8
country_id: 1733045
description:
Jan 23 15:24:46 sv3 pure-ftpd[1881239]: (oxboldc@175.143.223.8) [NOTICE] /home/oxboldc//public_html/paragliding-pilot-license-pl1.htm uploaded  (116479 bytes, 4308.35KB/sec)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-23 15:24:31 H=([77.83.39.187]) [77.83.39.187]:64975 F=<dina@backcombined.com> rejected RCPT <info@pftfood.com>: SPF: 77.83.39.187 is not allowed to send mail from backcombined.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.226.238.86
country_id: 2464461
description:
Jan 23 15:26:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.226.238.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.226.238.86
country_id: 2464461
description:
2026-01-23 15:26:24 dovecot_plain authenticator failed for H=(R9YP57Z8UQI) [196.226.238.86]:1093: 535 Incorrect authentication data (set_id=admin@tst-ma.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.61.139
country_id: 3469034
description:
Jan 23 15:26:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.61.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.98
country_id: 3469034
description:
Jan 23 15:26:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.98
country_id: 3469034
description:
Jan 23 15:27:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.223.8
country_id: 1733045
description:
Jan 23 15:27:25 sv3 pure-ftpd[1885414]: (oxboldc@175.143.223.8) [NOTICE] /home/oxboldc//public_html/paragliding-studentpilotcourse.htm uploaded  (134708 bytes, 3976.39KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.46
country_id: 1269750
description:
Jan 23 15:27:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 15:27:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61287: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.223.8
country_id: 1733045
description:
Jan 23 15:28:00 sv3 pure-ftpd[1885415]: (oxboldc@175.143.223.8) [NOTICE] /home/oxboldc//public_html/paragliding-pilot-license-pl2.htm uploaded  (125055 bytes, 1971.49KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.46
country_id: 1269750
description:
Jan 23 15:28:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.6.12.13
country_id: 1605651
description:
Jan 23 15:28:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.6.12.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.84.21.186
country_id: 798549
description:
Jan 23 15:28:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.84.21.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.30
country_id: 1269750
description:
Jan 23 15:28:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 15:29:53 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61305: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.84.21.186
country_id: 798549
description:
Jan 23 15:29:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.84.21.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.30
country_id: 1269750
description:
Jan 23 15:29:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.223.8
country_id: 1733045
description:
Jan 23 15:29:27 sv3 pure-ftpd[1888226]: (oxboldc@175.143.223.8) [NOTICE] /home/oxboldc//public_html/paragliding-pilot-license-pl2.htm uploaded  (125055 bytes, 4699.62KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 15:29:59 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61305: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.132
country_id: 3175395
description:
Jan 23 15:30:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.115
country_id: 6252001
description:
Jan 23 15:30:45 sv3 pure-ftpd[1890417]: (?@66.132.153.115) [INFO] New connection from 66.132.153.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.36
country_id: 3865483
description:
Jan 23 15:31:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.223.8
country_id: 1733045
description:
Jan 23 15:32:16 sv3 pure-ftpd[1892543]: (oxboldc@175.143.223.8) [NOTICE] /home/oxboldc//public_html/paragliding-pilot-license-pl2.htm uploaded  (125117 bytes, 4903.26KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.142
country_id: 3175395
description:
Jan 23 15:32:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 15:32:43 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61312: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 15:33:01 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61313: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.201.199.153
country_id: 1880251
description:
Jan 23 15:33:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.201.199.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.253
country_id: 953987
description:
Jan 23 15:34:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.40.41
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/event-dispatcher/Tests/GenericEventTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 210.87.68.64
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=235857 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.239.45.10
country_id: 1269750
description:
Jan 23 15:35:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.239.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.84.21.186
country_id: 798549
description:
Jan 23 15:35:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.84.21.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.211
country_id: 6290252
description:
Jan 23 15:35:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.253
country_id: 1269750
description:
Jan 23 15:35:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.253 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 123.136.105.39
country_id: 1733045
domain: rcct.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:123.136.105.39||TA:123.136.105.39||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.226.34.122
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-39.138.226.34.122||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 15:39:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.123.167
country_id: 690791
description:
Jan 23 15:40:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.123.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 15:40:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-23 15:41:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess4689359985/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 15:43:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61336: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.96.158.26
country_id: 3865483
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/3-1.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 15:45:07 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 84.54.72.161
country_id: 1512440
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/61-urw-bookman.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 15:47:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:15260: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-23 15:48:17 H=([77.83.39.187]) [77.83.39.187]:60274 F=<dina@backcombined.com> rejected RCPT <roz@af-sb.com>: SPF: 77.83.39.187 is not allowed to send mail from backcombined.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 15:49:32 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:25802: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 15:50:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:25803: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 15:51:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:15262: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 15:51:15 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.78.203.144
country_id: 1880251
domain: www.usfood.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/index.php||SC:/home2/usfoodcom/public_html/img/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-23 15:51:31 H=([45.144.212.242]) [45.144.212.242]:63918 F=<no_reply@admin.com> rejected RCPT <enquiry@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.171
country_id: 3175395
description:
Jan 23 15:51:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.9.94
country_id: 3996063
description:
Jan 23 15:52:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.9.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/img/video.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.53.31.95
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Tests/Formatter/OutputFormatterTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 15:53:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:25806: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 15:54:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:15264: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.250.187.174
country_id: 2542007
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteAreaStackedChart1.xlsx HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 15:54:19 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:15264: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.103.82.7
country_id: 3175395
description:
Jan 23 15:54:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.103.82.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.223.8
country_id: 1733045
description:
Jan 23 15:54:02 sv3 pure-ftpd[1926721]: (oxboldc@175.143.223.8) [NOTICE] /home/oxboldc//public_html/paragliding-studentpilotcourse.htm uploaded  (134957 bytes, 4909.79KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.9.52.130
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=37 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.103.82.7
country_id: 3175395
description:
Jan 23 15:55:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.103.82.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.52.73
country_id: 3658394
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=208488 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.255.112.58
country_id: 102358
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 15:56:22 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:25810: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 15:57:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:15266: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 15:57:28 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 15:58:31 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61325: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 15:58:06 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:15267: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 15:59:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53782: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 15:59:34 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:25814: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 16:00:41 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:15268: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 16:00:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:25815: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 16:00:25 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 16:01:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61359: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 16:01:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53800: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 16:01:15 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:15269: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
country_id: 1269750
description:
Jan 23 16:01:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.150.109.105
country_id: 6251999
description:
Jan 23 16:02:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.150.109.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 85.121.5.30
country_id: 798549
domain: aire-fresh.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/527.36 (KHTML, like Gecko) HeadlessChrome/120.4.6009.224 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 16:03:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:25818: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-23 16:05:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53853: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 16:05:17 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.7
country_id: 690791
description:
Jan 23 16:05:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.7
country_id: 690791
description:
Jan 23 16:06:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.4
country_id: 99237
description:
Jan 23 16:07:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-23 16:07:54 dovecot_plain authenticator failed for H=(afarapper) [65.20.133.4]:51650: 535 Incorrect authentication data (set_id=sales@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-23 16:07:17 H=([77.83.39.187]) [77.83.39.187]:62475 F=<dina@backcombined.com> rejected RCPT <ramesh@krisfood.com>: SPF: 77.83.39.187 is not allowed to send mail from backcombined.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.10.213.180
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/ResponseTestCase.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.210.67.74
country_id: 1269750
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/638851.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.254.182.151
country_id: 1269750
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/537304.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.42.136
country_id: 3469034
description:
Jan 23 16:10:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.42.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.196
country_id: 298795
description:
Jan 23 16:11:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.42.136
country_id: 3469034
description:
Jan 23 16:10:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.42.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.196
country_id: 298795
description:
Jan 23 16:12:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 16:12:10 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.213.144.134
country_id: 1269750
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/green.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.138
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/fonts/poppins/poppins-v5-latin-regular.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.77.145
country_id: 1562822
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/ritzleder.php?id=23&sub=11&subsub=44 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 16:18:27 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.87.74
country_id: 3469034
description:
Jan 23 16:19:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.87.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 16:19:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:15271: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.75.178
country_id: 3469034
description:
Jan 23 16:19:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.75.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 16:21:08 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:25824: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 16:22:02 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.148
country_id: 1269750
description:
2026-01-23 16:23:19 dovecot_login authenticator failed for H=(nsg-corporate-148.227.187.122.airtel.in) [122.187.227.148]:54715: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.148
country_id: 1269750
description:
Jan 23 16:23:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.141
country_id: 953987
description:
Jan 23 16:25:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.61
country_id: 3469034
description:
Jan 23 16:25:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 16:25:17 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.141
country_id: 953987
description:
Jan 23 16:26:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.141 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.242.111
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=38 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-23 16:27:37 H=([77.83.39.187]) [77.83.39.187]:61369 F=<dina@backcombined.com> rejected RCPT <pavitra@cordage.com.my>: SPF: 77.83.39.187 is not allowed to send mail from backcombined.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-23 16:28:25 H=([77.83.39.187]) [77.83.39.187]:62991 F=<dina@backcombined.com> rejected RCPT <info@astlog.com.my>: SPF: 77.83.39.187 is not allowed to send mail from backcombined.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 220.154.134.114
country_id: 1814991
description:
2026-01-23 16:29:40 H=([220.154.134.114]) [220.154.134.114]:64522 F=<dse_NA2@docusign.net> rejected RCPT <ap@wohcheong.com.my>: Unrouteable address


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.81
country_id: 3469034
description:
Jan 23 16:29:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.81
country_id: 3469034
description:
Jan 23 16:30:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 16:30:13 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 16:31:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61393: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.16.212.85
country_id: 3865483
description:
Jan 23 16:32:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.16.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.2.46.151
country_id: 1643084
description:
Jan 23 16:33:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.2.46.151 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 218.205.161.10
country_id: 1814991
description:
2026-01-23 16:35:15 595397 [Warning] Aborted connection 595397 to db: 'unconnected' user: 'unauthenticated' host: '218.205.161.10' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.97.34.54
country_id: 6252001
description:
2026-01-23 16:37:07 dovecot_login authenticator failed for H=([127.0.0.1]) [98.97.34.54]:26989: 535 Incorrect authentication data (set_id=info@jlconcepts.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-23 16:37:09 595640 [Warning] Aborted connection 595640 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.173.134
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97781523515747 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 16:37:05 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.24.60.81
country_id: 798544
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-38.82.24.60.81||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.212
country_id: 953987
description:
Jan 23 16:38:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.223.19
country_id: 798544
description:
Jan 23 16:39:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.223.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.212
country_id: 953987
description:
Jan 23 16:39:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.209
country_id: 953987
description:
Jan 23 16:39:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.158.55
country_id: 1562822
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/under-maintenance.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 16:41:21 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-23 16:41:44 H=([77.83.39.187]) [77.83.39.187]:54490 F=<dina@backcombined.com> rejected RCPT <mkadmin@mkmetal.com.my>: No Such User Here"


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.34.124.129
country_id: 1522867
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=749224 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.13.194.99
country_id: 1282988
domain: chs.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.chs.com.my||ServerName:chs.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.52
country_id: 690791
description:
2026-01-23 16:47:08 H=([45.144.212.52]) [45.144.212.52]:57245 F=<tomj@siglandscaping.com> rejected RCPT <fkr@fkr.com.my>: SPF: 45.144.212.52 is not allowed to send mail from siglandscaping.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 16:48:08 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.24
country_id: 1269750
description:
Jan 23 16:49:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.127
country_id: 3469034
description:
Jan 23 16:49:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 16:49:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:15279: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.24
country_id: 1269750
description:
Jan 23 16:50:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.59
country_id: 3865483
description:
Jan 23 16:50:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.48.96.199
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=53511514514721 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 16:51:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:25833: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.66.101.22
country_id: 3469034
description:
Jan 23 16:53:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.66.101.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-23 16:54:12 H=(localhost.localdomain) [45.150.192.143]:54862 F=<info@valencyexports.com> rejected RCPT <astpkg@astlog.com.my>: SPF: 45.150.192.143 is not allowed to send mail from valencyexports.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 16:54:34 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.220
country_id: 1269750
description:
Jan 23 16:55:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/img/photos/team.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.139
country_id: 3469034
description:
Jan 23 16:57:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.70.25.197
country_id: 458258
description:
Jan 23 16:57:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.70.25.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-23 16:58:46 H=(localhost.localdomain) [78.153.140.207]:46936 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.31
country_id: 3469034
description:
Jan 23 16:58:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.141.242
country_id: 99237
description:
Jan 23 16:59:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.141.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.35.192.98
country_id: 1814991
description:
Jan 23 16:59:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.35.192.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 16:59:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61427: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.254
country_id: 1269750
description:
Jan 23 16:59:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.254 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.238.100
country_id: 1562822
domain: astlog.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/astlog.com.my/wp-content/uploads/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.35.192.98
country_id: 1814991
description:
Jan 23 17:00:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.35.192.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 17:01:32 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.176.202
country_id: 1269750
description:
Jan 23 17:01:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.176.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.222.32
country_id: 1562822
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/services-detail.php?id=645047 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
country_id: 1814991
description:
Jan 23 17:02:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.172
country_id: 953987
description:
Jan 23 17:02:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.172
country_id: 953987
description:
Jan 23 17:02:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 17:03:09 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-23 17:05:45 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.53.67
country_id: 453733
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/3630216953.jpg&size=262*388 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/images/video.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-23 17:07:04 H=(localhost.localdomain) [78.153.140.207]:36480 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/images/contact.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 2921044
description:
Jan 23 17:10:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-23 17:10:30 dovecot_login authenticator failed for H=(User) [77.90.185.33]:49812: 535 Incorrect authentication data (set_id=pass)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.119.63.138
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/src/Psy/ContextAware.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/article.php||SC:/home/indfinitydesign/public_html/images/article.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.34.24
country_id: 3865483
description:
Jan 23 17:12:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.34.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.52
country_id: 2395170
description:
Jan 23 17:12:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.201
country_id: 3865483
description:
Jan 23 17:12:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.201
country_id: 3865483
description:
Jan 23 17:12:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.49
country_id: 953987
description:
Jan 23 17:13:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-23 17:14:49 dovecot_login authenticator failed for H=(User) [77.90.185.33]:2687: 535 Incorrect authentication data (set_id=ftp)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 2921044
description:
Jan 23 17:14:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-23 17:15:28 H=(localhost.localdomain) [78.153.140.207]:53450 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.249.129.161
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/YtsBasicTests.yml HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 17:17:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:15298: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.112.197.203
country_id: 102358
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97751523517829 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-23 17:19:19 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:25842: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.121.165
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82031515376325 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 2921044
description:
Jan 23 17:19:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-23 17:19:11 dovecot_login authenticator failed for H=(User) [77.90.185.33]:20060: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.20.84.54
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/tinker/src/TinkerServiceProvider.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-23 17:21:40 H=([77.83.39.187]) [77.83.39.187]:56498 F=<dina@backcombined.com> rejected RCPT <enquiry@smartcable.com.my>: SPF: 77.83.39.187 is not allowed to send mail from backcombined.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.77.252
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/mssa/index.php/newsletter/smy-oct-dec-2013/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-23 17:22:15 H=(localhost.localdomain) [45.150.192.143]:56678 F=<info@valencyexports.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.150.192.143 is not allowed to send mail from valencyexports.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.129.206.200
country_id: 3469034
description:
Jan 23 17:23:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.129.206.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.0.216.32
country_id: 2635167
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/evorezt1.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.129.206.200
country_id: 3469034
description:
Jan 23 17:24:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.129.206.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 172.224.240.21
country_id: 1733045
description:
[2026-01-23 17:25:50 +0800] info [webmaild] 172.224.240.21 - ismail@ajplantations.com.my "GET /cpsess2818977276/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [172.225.181.93] != Current IP Address [172.224.240.21]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 172.224.240.21
country_id: 1733045
description:
[2026-01-23 17:26:23 +0800] info [webmaild] 172.224.240.21 - ismail@ajplantations.com.my "POST /cpsess2818977276/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.171.82.21
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-26.192.171.82.21||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.148.108.31
country_id: 1210997
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/assets/js/jquery.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.252.69.68
country_id: 1210997
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/assets/js/foundation.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.128.171.249
country_id: 3996063
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/assets/js/owl.carousel.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.21.141.223
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/assets/js/template.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 17:27:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61451: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.146.174.199
country_id: 272103
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.90.28.92
country_id: 3865483
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/assets/js/lightbox.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.186.246.224
country_id: 248816
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/assets/css/foundation.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.147.131.17
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-32.142.147.131.17||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.14.186.240
country_id: 2464461
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/TranslatorListener.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.62
country_id: 3175395
description:
Jan 23 17:34:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.224.149
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-34.166.0.224.149||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.248.153
country_id: 3469034
description:
Jan 23 17:34:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.248.153 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 66.132.153.115
country_id: 6252001
description:
2026-01-23 17:35:11 597759 [Warning] Aborted connection 597759 to db: 'unconnected' user: 'unauthenticated' host: '66.132.153.115' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.132.68
country_id: 953987
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product.php?category=&page=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-23 17:37:33 H=(localhost.localdomain) [45.150.192.143]:44282 F=<info@valencyexports.com> rejected RCPT <cky@ahfengineering.com>: SPF: 45.150.192.143 is not allowed to send mail from valencyexports.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/keyword/img/druma_photos/contact.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.122.17
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=334061 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.185.170
country_id: 6252001
description:
2026-01-23 17:38:26 597837 [Warning] Aborted connection 597837 to db: 'unconnected' user: 'unauthenticated' host: '159.223.185.170' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-23 17:39:19 +0800] info [webmaild] 175.142.119.17 - sales2@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.27.235
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=982714 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.97.36
country_id: 3469034
description:
Jan 23 17:40:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.97.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.43.61
country_id: 3469034
description:
Jan 23 17:40:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.43.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-23 17:41:56 +0800] info [webmaild] 175.142.119.17 - sales2@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-23 17:42:04 +0800] info [webmaild] 175.142.119.17 - sales2@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-23 17:42:02 +0800] info [webmaild] 175.142.119.17 - sales2@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/home/article.php||SC:/home/indfinitydesign/public_html/images/home||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.188.218
country_id: 3469034
description:
Jan 23 17:52:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.188.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.234
country_id: 732800
description:
Jan 23 17:53:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-23 17:55:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:61520: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.122
country_id: 3175395
description:
Jan 23 17:56:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.191.39
country_id: 3469034
description:
Jan 23 17:57:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.191.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.188.144
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=7&page_id=1 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.122
country_id: 3175395
description:
Jan 23 17:57:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.68.19
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=955925 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.45
country_id: 298795
description:
Jan 23 18:00:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.68.86
country_id: 732800
description:
Jan 23 18:00:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.68.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.114
country_id: 953987
description:
Jan 23 18:02:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.44
country_id: 1269750
description:
Jan 23 18:02:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.173
country_id: 3175395
description:
Jan 23 18:04:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.27.203
country_id: 3469034
description:
Jan 23 18:04:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.27.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.160
country_id: 3469034
description:
Jan 23 18:04:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.160 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.191.143.242
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&page_id=3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.101
country_id: 3469034
description:
Jan 23 18:05:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.49
country_id: 3469034
description:
Jan 23 18:05:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.83.210
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=934113 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.194
country_id: 3175395
description:
Jan 23 18:05:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 18:08:32 H=([64.89.160.15]) [64.89.160.15]:53772 F=<drdavid000908@outlook.com> rejected RCPT <chuan@tschuan.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-23 18:09:53 +0800] info [webmaild] 175.142.119.17 - sales02@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-23 18:10:27 +0800] info [webmaild] 175.142.119.17 - sales02@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-23 18:11:24 +0800] info [webmaild] 175.142.119.17 - sales02@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-23 18:12:01 +0800] info [webmaild] 175.142.119.17 - sales02@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 18:12:19 H=([64.89.160.15]) [64.89.160.15]:57787 F=<drdavid000908@outlook.com> rejected RCPT <ind@indfinitydesign.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-23 18:12:00 +0800] info [webmaild] 175.142.119.17 - sales02@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.43
country_id: 3175395
description:
Jan 23 18:15:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.142
country_id: 1269750
description:
Jan 23 18:15:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.46
country_id: 3469034
description:
Jan 23 18:15:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.54.61
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-15.142.111.54.61||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.23
country_id: 798544
description:
Jan 23 18:15:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.250.201.58
country_id: 3469034
description:
Jan 23 18:15:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.250.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.161
country_id: 6252001
description:
Jan 23 18:15:49 sv3 pure-ftpd[2136083]: (?@167.94.138.161) [INFO] New connection from 167.94.138.161


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.161
country_id: 6252001
description:
Jan 23 18:16:02 sv3 pure-ftpd[2136153]: (?@167.94.138.161) [INFO] New connection from 167.94.138.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.46
country_id: 3469034
description:
Jan 23 18:16:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 167.94.138.161
country_id: 6252001
description:
Jan 23 18:16:05 sv3 pure-ftpd[2136160]: (?@167.94.138.161) [INFO] New connection from 167.94.138.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.24.34.253
country_id: 6290252
description:
Jan 23 18:16:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.24.34.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 23 18:17:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-23 18:18:00 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:65472: 535 Incorrect authentication data (set_id=reservation)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.136
country_id: 3469034
description:
Jan 23 18:18:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.136
country_id: 3469034
description:
Jan 23 18:19:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.141.134.246
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=182180 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.28
country_id: 1269750
description:
Jan 23 18:19:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.161.225
country_id: 1269750
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/BB1_5556.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.64.14.71
country_id: 1522867
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/5345f0b5-3c27-4110-9bfe-d2f3cf0287e5.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.229.93.97
country_id: 3865483
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/C7812.MP4_snapshot_00.05.930.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.131.128.113
country_id: 3658394
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/IMG_8946.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.51.53.19
country_id: 1210997
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/20200813_104700.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.192.101.65
country_id: 3865483
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/application/themes/bishop/fonts/biotif-regular-webfont.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.60.220
country_id: 99237
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/exhibition.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.190.231.65
country_id: 3865483
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/new5.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.102.254
country_id: 3865483
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/new1.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.192.220.172
country_id: 1168579
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/logoo-cabee.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.167.26.192
country_id: 933860
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/DSC00850.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.235.74
country_id: 1562822
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/DSC00719.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.30.198.50
country_id: 1562822
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/collage (5).jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.124.7
country_id: 99237
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/7a7c8891-b160-4a9c-9d17-fdef18f369b2.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 175.142.119.17
country_id: 1733045
description:
175.142.119.17 - - [23/Jan/2026:18:22:41 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13212825&pdata=https%253A%252F%252Fpftfood.com%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769163760 HTTP/2.0" 302 0 pftfood.com "https://pftfood.com:2096/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:175.142.119.17


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.57.31.130
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/scripts/php/contact-form.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.209.61.6
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/scripts/bootstrap/js/bootstrap.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.246.106.35
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/scripts/flexslider/flexslider.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.187.103.224
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/scripts/script.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.235.182.204
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.97.137.137
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=36951522226584 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.27.72.204
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/scripts/parallax.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.90.245.97
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/css/components.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.90.245.97
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/skin.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 18:24:32 H=([64.89.160.15]) [64.89.160.15]:56323 F=<essential@mailling.uk> rejected RCPT <chuan@tschuan.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
description:
2026-01-23 18:27:26 H=([64.89.160.15]) [64.89.160.15]:65333 F=<essential@mailling.uk> rejected RCPT <ind@indfinitydesign.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.119.196
country_id: 732800
description:
Jan 23 18:33:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.119.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.40.72
country_id: 3469034
description:
Jan 23 18:33:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.40.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.18.89
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.243.69.223
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78441528708517 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.238
country_id: 3175395
description:
Jan 23 18:37:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.167
country_id: 933860
description:
Jan 23 18:37:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.96
country_id: 3175395
description:
Jan 23 18:38:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.59
country_id: 953987
description:
Jan 23 18:38:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.59
country_id: 953987
description:
Jan 23 18:39:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.222
country_id: 3865483
description:
Jan 23 18:39:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.222
country_id: 3865483
description:
Jan 23 18:40:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.216.218
country_id: 3469034
description:
Jan 23 18:40:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.216.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.56.129
country_id: 1880251
domain: www.task.visoft.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 45.133.172.215
country_id: 2635167
domain: www.saps.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.38.104
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/gallery.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.19.34
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/certificate.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.182.64.238
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/product-details-acp.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.168.147
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&page_id=4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.75.78.249
country_id: 798544
description:
Jan 23 18:48:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.75.78.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 34.45.218.41
country_id: 6252001
domain: spacesys.com.my
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.198
country_id: 3469034
description:
Jan 23 18:50:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.120
country_id: 953987
description:
Jan 23 18:50:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.9.94
country_id: 3996063
description:
Jan 23 18:50:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.9.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.157.44
country_id: 1269750
description:
Jan 23 18:50:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.82.157.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 157.254.126.36
country_id: 6252001
domain: aoto.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; moto g41 Build/S3RWS32.138-29-5-5; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023109030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/31.9.3 ByteLocale/es ByteFullLocale/es Region/MX AppId/1233 Spark/1.4.3.5-bugfix AppVersion/31.9.3 BytedanceWebview/d8a21c6||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 156.242.51.137
country_id: 6251999
domain: plomalite.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.67||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.177
country_id: 3469034
description:
Jan 23 18:59:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.71.66.60
country_id: 3469034
description:
Jan 23 18:59:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.71.66.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.183.86
country_id: 3469034
description:
Jan 23 19:01:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.183.86 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.122
country_id: 3469034
description:
Jan 23 19:02:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.208.124
country_id: 933860
description:
Jan 23 19:02:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.208.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.183.86
country_id: 3469034
description:
Jan 23 19:02:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.183.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.108
country_id: 1269750
description:
Jan 23 19:02:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.208.124
country_id: 933860
description:
Jan 23 19:03:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.208.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.221
country_id: 953987
description:
Jan 23 19:03:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.221
country_id: 953987
description:
Jan 23 19:04:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.192
country_id: 953987
description:
Jan 23 19:04:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.192 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.197.85
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=124007 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.117.250.146
country_id: 2542007
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/news-details5.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.105.191
country_id: 1269750
description:
Jan 23 19:07:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.105.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.35.3
country_id: 1269750
description:
Jan 23 19:07:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.35.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.147
country_id: 798544
description:
Jan 23 19:07:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.105.191
country_id: 1269750
description:
Jan 23 19:08:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.105.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.6.61
country_id: 732800
description:
Jan 23 19:08:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.6.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.124.53
country_id: 1733045
description:
[2026-01-23 19:09:06 +0800] info [webmaild] 113.211.124.53 - s-osada@mckd.com.my "GET /cpsess8078519611/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D1%2Cwebp%3D1%2Cpgpmime%3D0&_uid=38640&_mbox=INBOX&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.253.150
country_id: 1269750
description:
Jan 23 19:11:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.253.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-23 19:11:04 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:39742: 535 Incorrect authentication data (set_id=promo@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.42
country_id: 3175395
description:
Jan 23 19:12:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-23 19:13:39 +0800] info [cpaneld] 165.22.212.32 - tujuseti "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tujuseti (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.143.185
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=645854 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.42
country_id: 3175395
description:
Jan 23 19:12:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.56
country_id: 3175395
description:
Jan 23 19:13:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.56 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 1.39.37.123
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:86968.dsc-expat.com||ServerName:dsc-expat.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:28a2035698289ae698f0b6e60ff62fc76e6228b2||Title:0x4a47134e||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.84
country_id: 3865483
description:
Jan 23 19:17:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.84
country_id: 3865483
description:
Jan 23 19:18:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.166
country_id: 2395170
description:
Jan 23 19:18:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.119.157
country_id: 732800
description:
Jan 23 19:18:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.119.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.178.36
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=94761514527303 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.152.147.177
country_id: 1210997
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/maalloys.com.my/images/exec-chairman-msg.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.136.216.8
country_id: 1643084
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=63&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.221
country_id: 3469034
description:
Jan 23 19:24:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.221 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.202.71.99
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-25.46.202.71.99||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.95.245.166
country_id: 6252001
domain: cloudhost.magsoft.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo VULN_TEST_123456 | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.65.174.239
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=29031516690246 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.29.80
country_id: 933860
description:
Jan 23 19:30:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.29.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.54
country_id: 3469034
description:
Jan 23 19:30:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.54
country_id: 3469034
description:
Jan 23 19:30:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.91
country_id: 3175395
description:
Jan 23 19:31:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.91
country_id: 3175395
description:
Jan 23 19:32:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.228.182
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=749224 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.107
country_id: 3469034
description:
Jan 23 19:34:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.163
country_id: 953987
description:
Jan 23 19:34:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.163 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.75
country_id: 3469034
description:
Jan 23 19:34:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.219
country_id: 3175395
description:
Jan 23 19:33:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.219 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.214
country_id: 6252001
description:
2026-01-23 19:34:14 601251 [Warning] Aborted connection 601251 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.214' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.75
country_id: 3469034
description:
Jan 23 19:35:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-23 19:35:56 H=([45.144.212.242]) [45.144.212.242]:60047 F=<no_reply@admin.com> rejected RCPT <enquiry@smartcable.com.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.55.249
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-36.142.111.55.249||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.193.174
country_id: 3865483
description:
Jan 23 19:36:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.193.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.176
country_id: 3469034
description:
Jan 23 19:36:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.215
country_id: 298795
description:
Jan 23 19:39:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.34.34.253
country_id: 2510769
description:
Jan 23 19:39:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.34.34.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.7.49
country_id: 1269750
description:
Jan 23 19:39:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.7.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.247.76.41
country_id: 3865483
description:
Jan 23 19:39:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.247.76.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.227
country_id: 2300660
description:
Jan 23 19:39:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 136.38.2.1
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.34.34.253
country_id: 2510769
description:
Jan 23 19:39:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.34.34.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.105.216.22
country_id: 3865483
description:
Jan 23 19:40:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.105.216.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.215
country_id: 298795
description:
Jan 23 19:39:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.140
country_id: 1269750
description:
Jan 23 19:40:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.105.216.22
country_id: 3865483
description:
Jan 23 19:40:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.105.216.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.13.69.103
country_id: 3175395
description:
Jan 23 19:41:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.13.69.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.163.239
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-43.171.236.163.239||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.61.243
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=26 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.252.153
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=5128 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.77.76
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=4338 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.210.75
country_id: 798544
description:
Jan 23 19:45:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.210.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.22.121
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=2&sub=8 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.76
country_id: 2510769
description:
Jan 23 19:45:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.210.75
country_id: 798544
description:
Jan 23 19:46:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.210.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.2
country_id: 99237
description:
Jan 23 19:46:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.45
country_id: 3469034
description:
Jan 23 19:46:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.45 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.153.171.7
country_id: 1210997
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=4336 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.114.212
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=9623 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.97.194
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=9918 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.233.115.133
country_id: 2802361
description:
Jan 23 19:49:47 sv3 pure-ftpd[2223463]: (?@35.233.115.133) [INFO] New connection from 35.233.115.133


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.125
country_id: 953987
description:
Jan 23 19:52:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.211.33
country_id: 6252001
description:
2026-01-23 19:53:10 H=([158.94.211.33]) [158.94.211.33]:56956 F=<nancyxia@tonixchem.com> rejected RCPT <shipping@cordage.com.my>: SPF: 158.94.211.33 is not allowed to send mail from tonixchem.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.89.216.12
country_id: 3469034
description:
Jan 23 19:53:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.89.216.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.29.2
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=88 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.205.166.110
country_id: 2802361
description:
Jan 23 19:54:14 sv3 pure-ftpd[2226091]: (?@35.205.166.110) [INFO] New connection from 35.205.166.110


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.112.81
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/demos/img/photos/img/demos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-59.77.238.251.212||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.62.74.215
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=54061516587340 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.12
country_id: 3469034
description:
Jan 23 20:01:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.150
country_id: 226074
description:
Jan 23 20:01:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.227
country_id: 3175395
description:
Jan 23 20:02:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.196
country_id: 3996063
description:
Jan 23 20:01:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.140
country_id: 798544
description:
Jan 23 20:02:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.7
country_id: 690791
description:
2026-01-23 20:01:59 H=([45.144.212.7]) [45.144.212.7]:49460 F=<info@nicekitchenuae.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-02.77.238.251.212||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.113
country_id: 953987
description:
Jan 23 20:02:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.140
country_id: 798544
description:
Jan 23 20:03:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.34.18
country_id: 226074
description:
Jan 23 20:04:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.34.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.187
country_id: 798544
description:
Jan 23 20:04:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.187 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.70.28
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=11 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.160.183
country_id: 1562822
domain: www.eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.eminent.st/merge/article/ride-the-tech-gains-not-the-tech-hype/index.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.49
country_id: 298795
description:
Jan 23 20:06:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.218.4
country_id: 99237
description:
Jan 23 20:06:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.218.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.165.19
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=471602 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.120
country_id: 2750405
description:
2026-01-23 20:09:05 602670 [Warning] Aborted connection 602670 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.120' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.202.162
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-09.171.224.202.162||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
country_id: 290557
description:
Jan 23 20:09:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-23 20:09:24 dovecot_login authenticator failed for H=([5.32.61.6]) [5.32.61.6]:49376: 535 Incorrect authentication data (set_id=it@essemgroup.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.120
country_id: 2750405
description:
2026-01-23 20:12:51 602795 [Warning] Aborted connection 602795 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.120' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.120
country_id: 2750405
description:
2026-01-23 20:13:39 602818 [Warning] Aborted connection 602818 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.120' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.201.244
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-13.171.224.201.244||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.37.251.194
country_id: 1269750
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/index.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.96.55.137
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-16.116.96.55.137||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.11.219
country_id: 617790
description:
Jan 23 20:17:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.11.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.99
country_id: 3175395
description:
Jan 23 20:17:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.194
country_id: 2510769
description:
Jan 23 20:17:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.140
country_id: 3175395
description:
Jan 23 20:18:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.121
country_id: 798544
description:
Jan 23 20:18:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.11.219
country_id: 617790
description:
Jan 23 20:18:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.11.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.250
country_id: 226074
description:
Jan 23 20:18:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.121
country_id: 798544
description:
Jan 23 20:18:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.42.92
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-19.142.111.42.92||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.127.40.150
country_id: 3469034
description:
Jan 23 20:21:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.127.40.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.84.92.45
country_id: 1655842
description:
Jan 23 20:28:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.84.92.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.84.92.45
country_id: 1655842
description:
2026-01-23 20:28:18 dovecot_login authenticator failed for H=([115.84.92.45]) [115.84.92.45]:39355: 535 Incorrect authentication data (set_id=it@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.242.79.224
country_id: 102358
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=43821526632107 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.253.147.185
country_id: 2802361
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-29.104.253.147.185||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-23 20:34:02 603472 [Warning] Aborted connection 603472 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.221
country_id: 3469034
description:
Jan 23 20:35:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.226.253
country_id: 3865483
description:
Jan 23 20:36:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.226.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.155.202
country_id: 6252001
domain: www.eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.eminent.st/v3/wp-content/uploads/2016/11/takeo-cny2015-1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.107.228
country_id: 1269750
description:
2026-01-23 20:37:32 dovecot_plain authenticator failed for H=(Q171B58071) [157.48.107.228]:53204: 535 Incorrect authentication data (set_id=kendek@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.88
country_id: 3469034
description:
Jan 23 20:39:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 206.206.124.134
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-40.206.206.124.134||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.88
country_id: 3469034
description:
Jan 23 20:39:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.105.144
country_id: 3865483
description:
Jan 23 20:40:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.105.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.138
country_id: 3469034
description:
Jan 23 20:40:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.112
country_id: 2300660
description:
Jan 23 20:41:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.112 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2026-01-23 20:41:53 +0800] info [cpaneld] 51.75.254.157 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 134.122.126.55
country_id: 6252001
description:
2026-01-23 20:42:45 603764 [Warning] Aborted connection 603764 to db: 'unconnected' user: 'unauthenticated' host: '134.122.126.55' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.227.2.51
country_id: 6252001
description:
2026-01-23 20:42:46 603765 [Warning] Aborted connection 603765 to db: 'unconnected' user: 'unauthenticated' host: '64.227.2.51' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.15.203
country_id: 3469034
description:
Jan 23 20:42:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.15.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.157
country_id: 3175395
description:
Jan 23 20:42:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.157 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.245.137.242
country_id: 6252001
description:
2026-01-23 20:42:46 603766 [Warning] Aborted connection 603766 to db: 'unconnected' user: 'unauthenticated' host: '157.245.137.242' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.157
country_id: 3175395
description:
Jan 23 20:43:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.157 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.242.81
country_id: 1733045
description:
[2026-01-23 20:44:27 +0800] info [webmaild] 27.125.242.81 - chuacp@ms-chemicals.net "GET /cpsess3456854464/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.242.151.250
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/img/photos/.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.62.15.108
country_id: 3585968
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/contact.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.38.252.137
country_id: 6252001
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/images/u1923-48.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.250.133
country_id: 2395170
description:
Jan 23 20:50:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.250.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.22
country_id: 3469034
description:
Jan 23 20:52:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.22
country_id: 3469034
description:
Jan 23 20:52:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.178
country_id: 2510769
description:
Jan 23 20:53:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.55
country_id: 6252001
description:
2026-01-23 20:55:35 604124 [Warning] Aborted connection 604124 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.55' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 216.247.82.214
country_id: 1694008
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p class=\"msonormal\">january 23, 2026,</p>\r\n<p class=\"msonormal\">assist delivery schedule</p>\r\n<p class=\"msonormal\">big truck: pull out all the stock at lipa container</p>\r\n<p class=\"msonormal\">small truck valbuena, vgc holding, puyat farm, doc modomo farm</p>\r\n<p class=\"msonormal\">banking</p>\r\n<p class=\"msonormal\">-deposit to bdo the payment for the qne system</p>\r\n<p class=\"msonormal\">walk in client</p>\r\n<p class=\"msonormal\">-no walkin client</p>\r\n<p class=\"msonormal\">went to acgs malvar to bring to the check payment to acgs, this is to secure the 300 bags of lucern at old price</p>\r\n<p class=\"msonormal\">follow up to other repair shop regarding the repair and pms of the black pick up, already got the 1<sup>st</sup> quotation to follow up the 2<sup>nd</sup> one</p>\r\n<p class=\"msonormal\">discuss with ms. chin regarding the for disposal in the warehouse (old documents and some items in the container</p>\r\n<p class=\"msonormal\">locate a new supplier that we can buy the electric tape with different color to discus with the sales how much acgs sells and the fast moving color</p>\r\n<p class=\"msonormal\"><span lang=\"en-us\" style=\"mso-ansi-language: en-us;\">&nbsp;</span></p>||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.17.83.4
country_id: 3437598
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=65 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.154.167
country_id: 3469034
description:
Jan 23 21:02:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.154.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.246.211
country_id: 3865483
description:
Jan 23 21:04:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.246.211 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.31.155.235
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&page_id=8 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.138
country_id: 3469034
description:
Jan 23 21:06:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/login.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.131.204.197
country_id: 3469034
description:
Jan 23 21:06:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.131.204.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.220.230
country_id: 1814991
description:
Jan 23 21:10:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.220.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.220.230
country_id: 1814991
description:
2026-01-23 21:10:42 dovecot_login authenticator failed for H=([120.194.220.230]) [120.194.220.230]:11929: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.23.14.209
country_id: 798544
description:
Jan 23 21:11:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.23.14.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.126
country_id: 953987
description:
Jan 23 21:11:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.35.88
country_id: 2017370
description:
2026-01-23 21:11:04 dovecot_login authenticator failed for H=([178.70.35.88]) [178.70.35.88]:49342: 535 Incorrect authentication data (set_id=hello@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.101
country_id: 798544
description:
Jan 23 21:15:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.75
country_id: 3469034
description:
Jan 23 21:15:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.225.156
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=812301 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.248.20
country_id: 3469034
description:
Jan 23 21:20:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.248.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.248
country_id: 3469034
description:
Jan 23 21:20:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.248.20
country_id: 3469034
description:
Jan 23 21:20:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.248.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/eco.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.205
country_id: 2300660
description:
Jan 23 21:21:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.175.107.93
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=33551516779661 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.19.9.232
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=916248 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.211.33
country_id: 6252001
description:
2026-01-23 21:24:53 H=([158.94.211.33]) [158.94.211.33]:57390 F=<nancyxia@tonixchem.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 158.94.211.33 is not allowed to send mail from tonixchem.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.88
country_id: 2750405
description:
2026-01-23 21:27:50 H=([185.214.10.88]) [185.214.10.88]:63431 F=<info@ktlog.com.my> rejected RCPT <inquiries@ktlog.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.170.172
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603392 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.179
country_id: 3175395
description:
Jan 23 21:33:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.179 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.80.53
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88281514945748 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.214
country_id: 798544
description:
Jan 23 21:33:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.201.88
country_id: 1814991
domain: www.indfinitydesign.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.121.50.130
country_id: 6252001
domain: spacesys.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.67||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.244.255.243
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/products.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.244.255.243
country_id: 3469034
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/products.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.78.191
country_id: 3469034
description:
Jan 23 21:36:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.78.191
country_id: 3469034
description:
Jan 23 21:37:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.203
country_id: 3469034
description:
Jan 23 21:37:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.23
country_id: 3865483
description:
Jan 23 21:37:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.46
country_id: 798544
description:
Jan 23 21:37:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.157.212.152
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-38.185.157.212.152||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.152
country_id: 3469034
description:
Jan 23 21:38:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.46
country_id: 798544
description:
Jan 23 21:38:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.152
country_id: 3469034
description:
Jan 23 21:39:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.152 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.157.212.152
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-39.185.157.212.152||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.92
country_id: 3865483
description:
Jan 23 21:39:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.53.103
country_id: 953987
description:
Jan 23 21:40:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.53.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.179
country_id: 953987
description:
Jan 23 21:40:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.179 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.125.3
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=442049 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.99
country_id: 1269750
description:
Jan 23 21:42:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.6.19
country_id: 2300660
description:
Jan 23 21:42:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.6.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.103.184
country_id: 3469034
description:
Jan 23 21:43:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.103.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.136
country_id: 3469034
description:
Jan 23 21:44:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.186
country_id: 3865483
description:
Jan 23 21:45:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.76.88
country_id: 732800
description:
Jan 23 21:49:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.76.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.181.245.184
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-50.185.181.245.184||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.123.39
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-51.89.110.123.39||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.55.216
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-51.142.111.55.216||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.106.190
country_id: 3175395
description:
Jan 23 21:54:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.106.190 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.253.53
country_id: 3017382
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-56.216.26.253.53||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.133.4.105
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/2343902730.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.34.240
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-56.45.3.34.240||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.49.247
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-56.45.3.49.247||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.23
country_id: 3469034
description:
Jan 23 21:56:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.23 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.249.174
country_id: 3175395
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-56.216.26.249.174||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.157.215
country_id: 99237
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5947454686.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.213.252.88
country_id: 1269750
description:
Jan 23 21:57:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.213.252.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.94.178.111
country_id: 6252001
description:
Jan 23 21:57:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.94.178.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jan 23 21:58:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.230.238
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=158210 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.249.53.157
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-02.104.249.53.157||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 117.156.118.58
country_id: 1814991
description:
Jan 23 22:03:51 sv3 pure-ftpd[2319326]: (?@117.156.118.58) [INFO] New connection from 117.156.118.58


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 117.156.118.58
country_id: 1814991
description:
Jan 23 22:03:54 sv3 pure-ftpd[2319326]: (?@117.156.118.58) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.133.116.71
country_id: 798544
description:
Jan 23 22:08:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.133.116.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.7
country_id: 690791
description:
Jan 23 22:08:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 173.244.56.145
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-08.173.244.56.145||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.241.225.126
country_id: 2017370
description:
Jan 23 22:09:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.241.225.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.241.225.126
country_id: 2017370
description:
2026-01-23 22:09:55 dovecot_login authenticator failed for H=([92.241.225.126]) [92.241.225.126]:54908: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.130.6
country_id: 99237
description:
Jan 23 22:10:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.130.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.175
country_id: 3175395
description:
Jan 23 22:11:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.229.237.118
country_id: 294640
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=135803 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.167.248
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/history.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.105.107.123
country_id: 1733045
domain: www.mokshana.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mokshana.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.196
country_id: 690791
description:
Jan 23 22:17:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.25.240
country_id: 1562822
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/announcement-detail.php?id=710158 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.166
country_id: 3469034
description:
Jan 23 22:18:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.166
country_id: 3469034
description:
Jan 23 22:19:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/component/tag/img/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.38.41
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psy/psysh/src/Psy/Sudo HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.106.86.156
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psy/psysh/src/Psy/Sudo/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.135.109
country_id: 690791
description:
Jan 23 22:23:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.135.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.161.96.107
country_id: 6252001
description:
Jan 23 22:25:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.161.96.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-23 22:25:10 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (appet) [73.161.96.107]:46480: 535 Incorrect authentication data (set_id=sales2@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.79.129.119
country_id: 1562822
description:
Jan 23 22:27:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.79.129.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.79.129.119
country_id: 1562822
description:
2026-01-23 22:27:21 dovecot_login authenticator failed for H=([27.79.129.119]) [27.79.129.119]:56566: 535 Incorrect authentication data (set_id=meemee@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.35
country_id: 3175395
description:
Jan 23 22:28:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.35
country_id: 3175395
description:
Jan 23 22:29:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.101.221
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.158.146.175
country_id: 2400553
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Session/SessionBagInterface.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.86.137.217
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/storage/framework/cache/data/08/d1/08d10e76d8945b9d6660cc9e149acffc6742b8fe HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-23 22:31:27 H=([45.144.212.242]) [45.144.212.242]:61145 F=<lynnied@mhtc.net> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-23 22:33:56 H=([45.144.212.242]) [45.144.212.242]:63611 F=<lynnied@mhtc.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.227.2.51
country_id: 6252001
description:
2026-01-23 22:34:40 607468 [Warning] Aborted connection 607468 to db: 'unconnected' user: 'unauthenticated' host: '64.227.2.51' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.7
country_id: 2395170
description:
Jan 23 22:34:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.7 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 143.198.188.11
country_id: 6252001
description:
2026-01-23 22:34:38 607466 [Warning] Aborted connection 607466 to db: 'unconnected' user: 'unauthenticated' host: '143.198.188.11' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 165.227.192.133
country_id: 6252001
description:
2026-01-23 22:34:40 607467 [Warning] Aborted connection 607467 to db: 'unconnected' user: 'unauthenticated' host: '165.227.192.133' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.7
country_id: 2395170
description:
Jan 23 22:35:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.7 has been locked due to Imunify RBL


