# incident

plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:05:26 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess7524580043/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:06:07 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "GET /cpsess7524580043/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1769522767478&_=1769475289435 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:07:08 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess2179679453/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.186.142
country_id: 1562822
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/our-brand HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:08:09 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess2179679453/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/iso.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:09:09 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess2179679453/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.76
country_id: 3865483
description:
Jan 27 22:12:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.76 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 22:13:03 H=(localhost.localdomain) [78.153.140.207]:35110 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.76
country_id: 3865483
description:
Jan 27 22:13:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.23
country_id: 3469034
description:
Jan 27 22:16:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 22:16:28 H=([45.144.212.242]) [45.144.212.242]:60435 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.253.0.7
country_id: 953987
description:
2026-01-27 22:21:40 H=([102.254.0.12]) [102.253.0.7]:26708 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@oxbold.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.160.233
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/YtsNullsAndEmpties.yml HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 22:28:05 H=([45.144.212.242]) [45.144.212.242]:61770 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.195
country_id: 3469034
description:
Jan 27 22:28:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 22:29:53 H=(localhost.localdomain) [78.153.140.207]:43048 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 22:30:05 H=([45.144.212.242]) [45.144.212.242]:54159 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 22:30:41 H=(localhost.localdomain) [78.153.140.207]:56206 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.95.54.132
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.42.86
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-33.171.236.42.86||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.115.93.59
country_id: 2542007
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteColumnPercentageChart1.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.142.79.87
country_id: 2658434
description:
2026-01-27 22:35:31 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [79.142.79.87]:1501: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 142.93.211.177
country_id: 1269750
description:
2026-01-27 22:38:31 836035 [Warning] Aborted connection 836035 to db: 'unconnected' user: 'unauthenticated' host: '142.93.211.177' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.108.92.247
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/jakub-onderka/php-console-highlighter/tests HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.73.161.35
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/jakub-onderka/php-console-highlighter/tests/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.204.11.44
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=55291515046355 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.216.188
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/clientele.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 223.207.227.187
country_id: 1605651
description:
2026-01-27 22:44:43 836238 [Warning] Aborted connection 836238 to db: 'unconnected' user: 'unauthenticated' host: '223.207.227.187' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 44.244.32.34
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/re.php||SC:/home2/fkrcom/public_html/img/re.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.0.122.69
country_id: 3469034
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/product-detail.php?id=227861 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.170.79
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-46.171.236.170.79||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.138
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/fonts/Flaticon.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.179
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.219
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/rsmenu-main.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.229
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/responsive.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.162
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/fonts/flaticon.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.169
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/off-canvas.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.209
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/magnific-popup.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.188
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/font-awesome.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.242.102
country_id: 1269750
description:
Jan 27 22:47:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.242.102 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.226
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/animate.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.240
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/owl.carousel.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/assets/css/rs-spacing.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.53.194.17
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/foot/422/422532 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-27 22:51:02 H=([62.60.130.227]) [62.60.130.227]:55288 F=<9492792029@vtext.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from vtext.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.84
country_id: 798544
description:
Jan 27 23:00:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.160.237
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-00.171.236.160.237||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.212
country_id: 3469034
description:
Jan 27 23:00:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.212
country_id: 3469034
description:
Jan 27 23:01:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.104.156
country_id: 1562822
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/approach.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.15.113.142
country_id: 1605651
description:
2026-01-27 23:09:14 H=([209.15.113.142]) [209.15.113.142]:49858 F=<voicemail@serverdata.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.222.167.127
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739603 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.150
country_id: 6252001
description:
Jan 27 23:10:48 sv3 pure-ftpd[3021395]: (?@205.210.31.150) [INFO] New connection from 205.210.31.150


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/osl.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.89.5
country_id: 1269750
description:
Jan 27 23:14:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.89.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-27 23:14:32 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:33166: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
country_id: 1814991
description:
Jan 27 23:15:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2026-01-27 23:15:08 dovecot_login authenticator failed for H=([39.165.183.70]) [39.165.183.70]:53232: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.69
country_id: 298795
description:
Jan 27 23:17:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 134.122.89.91
country_id: 2921044
domain: kdiballoon.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.62.211.155
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-17.158.62.211.155||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.80
country_id: 2510769
description:
Jan 27 23:19:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/rpl.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.190.38.132
country_id: 3077311
description:
Jan 27 23:24:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.190.38.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 27 23:27:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-27 23:27:38 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:54379: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 23:30:37 H=([45.144.212.242]) [45.144.212.242]:64894 F=<no_reply@admin.com> rejected RCPT <joseph@symphony-led.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.101
country_id: 6252001
description:
Jan 27 23:35:58 sv3 pure-ftpd[3040836]: (?@198.235.24.101) [INFO] New connection from 198.235.24.101


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 104.28.197.239
country_id: 1733045
domain: masaakisb.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/406/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 104.28.197.239
country_id: 1733045
domain: masaakisb.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.67||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/406/feedback||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.60.233.159
country_id: 3017382
description:
[2026-01-27 23:38:37 +0800] info [cpaneld] 37.60.233.159 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.85.208.4
country_id: 798544
description:
Jan 27 23:39:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.85.208.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.149.43
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/about-us/faq/images/index.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.107.81.125
country_id: 732800
description:
Jan 27 23:44:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.107.81.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.231
country_id: 3175395
description:
Jan 27 23:45:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.231 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.225
country_id: 6252001
description:
2026-01-27 23:45:16 838240 [Warning] Aborted connection 838240 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.225' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.237
country_id: 2395170
description:
Jan 27 23:47:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.159.150.111
country_id: 3469034
description:
Jan 27 23:48:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.159.150.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.150.111
country_id: 3469034
description:
2026-01-27 23:48:30 dovecot_login authenticator failed for H=(cnmp.static.gvt.net.br) [177.159.150.111]:46900: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.242.52.27
country_id: 1269750
description:
Jan 27 23:53:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.242.52.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 23:53:17 H=(localhost.localdomain) [78.153.140.207]:45014 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 118.31.228.30
country_id: 1814991
description:
2026-01-27 23:53:35 838477 [Warning] Aborted connection 838477 to db: 'unconnected' user: 'unauthenticated' host: '118.31.228.30' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.242.40
country_id: 1269750
description:
Jan 27 23:54:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.242.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/radiation.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 90.195.30.241
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/byecake/11/423/1137273 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.246.242
country_id: 3865483
description:
Jan 28 00:05:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.246.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.201
country_id: 3175395
description:
Jan 28 00:05:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.246.242
country_id: 3865483
description:
Jan 28 00:06:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.246.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.160.113
country_id: 1562822
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/carsdrifttnc.htm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.9.235
country_id: 1512440
description:
Jan 28 00:12:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.9.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.9.235
country_id: 1512440
description:
Jan 28 00:13:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.9.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/login.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.98.214.169
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=306191 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.0.30.44
country_id: 2635167
description:
[2026-01-28 00:16:41 +0800] info [webmaild] 161.0.30.44 - kendek@kendek.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.183.61
country_id: 6252001
description:
Jan 28 00:16:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.23.183.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.23.35
country_id: 2635167
description:
Jan 28 00:16:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.250.23.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 28 00:18:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.211.39.86
country_id: 1814991
description:
Jan 28 00:18:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.211.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.211.39.86
country_id: 1814991
description:
2026-01-28 00:18:59 dovecot_login authenticator failed for H=([58.211.39.86]) [58.211.39.86]:59025: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 84.37.219.199
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-20.84.37.219.199||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.201
country_id: 3865483
description:
Jan 28 00:21:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.26.226.95
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70988.krisfood.com||ServerName:krisfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c49afcaad1711be5ab4f3b0478ee223413a1179a||Title:0x40d39c09||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.183.61
country_id: 6252001
description:
Jan 28 00:23:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.23.183.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.23.35
country_id: 2635167
description:
Jan 28 00:23:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.250.23.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.59.147.162
country_id: 1269750
description:
Jan 28 00:23:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.59.147.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.147.162
country_id: 1269750
description:
2026-01-28 00:23:48 dovecot_plain authenticator failed for H=(I7QG1XB55L1Y) [152.59.147.162]:33734: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.203.67.115
country_id: 1269750
description:
Jan 28 00:23:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.203.67.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.183.61
country_id: 6252001
description:
Jan 28 00:24:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.23.183.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.9.235
country_id: 1512440
description:
Jan 28 00:24:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.9.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cert.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.203.67.115
country_id: 1269750
description:
Jan 28 00:25:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.203.67.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 28 00:25:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.227.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 28 00:25:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/iso.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.23.35
country_id: 2635167
description:
Jan 28 00:32:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.250.23.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 28 00:34:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.227.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/sitemap.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 28 00:35:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.227.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.23.35
country_id: 2635167
description:
Jan 28 00:38:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.250.23.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 00:38:11 H=([46.151.182.48]) [46.151.182.48]:49800 F=<cpanel@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 28 00:38:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 00:39:24 H=([46.151.182.48]) [46.151.182.48]:52205 F=<cpanel@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 28 00:39:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.183.61
country_id: 6252001
description:
Jan 28 00:39:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.23.183.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.170
country_id: 6252001
description:
Jan 28 00:41:32 sv3 pure-ftpd[3087401]: (?@198.235.24.170) [INFO] New connection from 198.235.24.170


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.37.221.237
country_id: 2963597
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteColumnChart2.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.23.35
country_id: 2635167
description:
Jan 28 00:42:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.250.23.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.228.197
country_id: 1282988
description:
Jan 28 00:45:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.228.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 00:45:37 H=([46.151.182.48]) [46.151.182.48]:63497 F=<cpanel@astlog.com.my> rejected RCPT <info@astlog.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/sitemap.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.203
country_id: 3865483
description:
Jan 28 00:50:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.203 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.106
country_id: 6252001
description:
2026-01-28  0:51:45 840306 [Warning] Aborted connection 840306 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.106' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 00:53:27 H=([46.151.182.48]) [46.151.182.48]:56695 F=<cpanel@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.67
country_id: 3175395
description:
Jan 28 00:57:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.129.65.101
country_id: 1168579
description:
2026-01-28 00:57:27 dovecot_plain authenticator failed for H=(E1261D68V5UP6) [122.129.65.101]:41948: 535 Incorrect authentication data (set_id=kuan-wen.lee@cofreth.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 00:57:32 H=([46.151.182.48]) [46.151.182.48]:64542 F=<cpanel@astlog.com.my> rejected RCPT <mustapa@astlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.91
country_id: 3175395
description:
Jan 28 00:57:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.226.156
country_id: 3057568
description:
Jan 28 00:58:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.226.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.121
country_id: 3469034
description:
Jan 28 00:59:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/images/introduction-service.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.165
country_id: 732800
description:
Jan 28 01:01:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.3
country_id: 2395170
description:
Jan 28 01:01:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.3
country_id: 2395170
description:
Jan 28 01:02:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.3 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.30.80
country_id: 1819730
domain: www.eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.eminent.st/v3/wp-content/uploads/2016/11/takeo-cny2016-1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 175.29.129.161
country_id: 6252001
domain: www.astlog.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 14; moto g 5G - 2023 Build/U1TPNS34.26-78-3-1; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/125.0.6422.34 Mobile Safari/537.36 musical_ly_2023404030 JsSdk/1.0 NetType/MOBILE Channel/googleplay AppName/musical_ly app_version/34.4.3 ByteLocale/en ByteFullLocale/en Region/US AppId/1233 Spark/1.5.4.7-bugfix AppVersion/34.4.3 BytedanceWebview/d8a21c6||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.94
country_id: 6252001
description:
2026-01-28  1:08:51 840806 [Warning] Aborted connection 840806 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.94' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-28 01:11:00 H=(localhost.localdomain) [78.153.140.207]:41500 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.242.177.19
country_id: 2782113
description:
2026-01-28  1:15:16 840992 [Warning] Aborted connection 840992 to db: 'unconnected' user: 'unauthenticated' host: '185.242.177.19' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.177.19
country_id: 2782113
description:
Jan 28 01:15:16 sv3 pure-ftpd[3111768]: (?@185.242.177.19) [INFO] New connection from 185.242.177.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.68
country_id: 2395170
description:
Jan 28 01:16:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.191
country_id: 2510769
description:
Jan 28 01:16:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.167.166.30
country_id: 1562822
description:
Jan 28 01:16:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.167.166.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.167.166.30
country_id: 1562822
description:
2026-01-28 01:16:56 dovecot_plain authenticator failed for H=(d469gabs6nhixd98n1unu) [14.167.166.30]:48049: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.110.97.54
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-23.116.110.97.54||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.222
country_id: 2510769
description:
Jan 28 01:23:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.31.139
country_id: 798544
description:
Jan 28 01:23:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.31.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: spacesys.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1769534807_9013',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.125
country_id: 3865483
description:
Jan 28 01:27:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.38
country_id: 298795
description:
Jan 28 01:28:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.98.90
country_id: 3469034
description:
Jan 28 01:28:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.98.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.11.109
country_id: 1814991
description:
2026-01-28 01:28:00 H=(localhost.localdomain) [122.114.11.109]:60714 F=<s1132148@srvape.com> rejected RCPT <info@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.98.90
country_id: 3469034
description:
Jan 28 01:29:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.98.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.173
country_id: 2510769
description:
Jan 28 01:29:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.173 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.245.99.130
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-31.171.245.99.130||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.207.213.254
country_id: 1694008
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cap/18/581/1814584 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.126.94.199
country_id: 2623032
description:
Jan 28 01:39:36 sv3 pure-ftpd[3126806]: (?@188.126.94.199) [INFO] New connection from 188.126.94.199


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.228.148
country_id: 2589581
description:
Jan 28 01:39:36 sv3 pure-ftpd[3126813]: (?@176.125.228.148) [INFO] New connection from 176.125.228.148


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.143
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/monthlyletter/images/tyresafetytips.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.146.45
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.144.201.3
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/date/384/174084 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.156.147.181
country_id: 2623032
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/img/photos/6656708877.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.17
country_id: 1269750
description:
Jan 28 01:49:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.155
country_id: 1269750
description:
Jan 28 01:49:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.126
country_id: 953987
description:
Jan 28 01:50:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.42
country_id: 798544
description:
Jan 28 01:50:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.126
country_id: 953987
description:
Jan 28 01:51:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.195
country_id: 953987
description:
Jan 28 01:51:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.153
country_id: 3469034
description:
Jan 28 01:51:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.153
country_id: 3469034
description:
Jan 28 01:52:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.152
country_id: 732800
description:
2026-01-28 01:55:37 H=([94.156.152.152]) [94.156.152.152]:59719 F=<altawashtrading_15@yahoo.com> rejected RCPT <wilson@oxbold.com>: No Such User Here


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.99.151.176
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7018710133.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
country_id: 1814991
description:
Jan 28 01:59:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
country_id: 1814991
description:
Jan 28 02:00:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.74.136.103
country_id: 3469034
description:
Jan 28 02:01:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.74.136.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 220.154.134.114
country_id: 1814991
description:
2026-01-28 02:06:11 H=([220.154.134.114]) [220.154.134.114]:52863 F=<dse_NA2@docusign.net> rejected RCPT <elaine@lvconsult.com.my>: SPF: 220.154.134.114 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.199.10.239
country_id: 453733
domain: www.geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-06.196.199.10.239||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.102.180.254
country_id: 3017382
domain: www.geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-06.194.102.180.254||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 165.231.70.103
country_id: 2921044
domain: www.geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-06.165.231.70.103||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.223.234.167
country_id: 2635167
domain: www.geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-07.185.223.234.167||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.73.24
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-12.50.117.73.24||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.37.131.169
country_id: 3017382
description:
[2026-01-28 02:15:37 +0800] info [cpaneld] 54.37.131.169 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.161.134
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-17.166.0.161.134||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.37.138.168
country_id: 1835841
description:
Jan 28 02:22:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.37.138.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.139
country_id: 2300660
description:
Jan 28 02:22:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.139
country_id: 2300660
description:
Jan 28 02:23:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.16.25
country_id: 2300660
description:
Jan 28 02:23:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.16.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.38
country_id: 953987
description:
Jan 28 02:24:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.68.213
country_id: 732800
description:
Jan 28 02:24:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.43.16.189
country_id: 3175395
description:
Jan 28 02:24:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.43.16.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.38
country_id: 953987
description:
Jan 28 02:25:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.159
country_id: 3175395
description:
Jan 28 02:26:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.251
country_id: 732800
description:
Jan 28 02:28:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.207
country_id: 3469034
description:
Jan 28 02:28:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.17
country_id: 3175395
description:
Jan 28 02:35:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.50
country_id: 3175395
description:
Jan 28 02:35:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.50 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.223
country_id: 6252001
description:
2026-01-28  2:36:17 843671 [Warning] Aborted connection 843671 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.223' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.36.77.60
country_id: 597427
description:
Jan 28 02:39:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.36.77.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.119
country_id: 3469034
description:
Jan 28 02:40:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/enquiry.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.114.55.81
country_id: 2921044
description:
[2026-01-28 02:45:49 +0800] info [webmaild] 74.114.55.81 - kendek@kendek.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.251
country_id: 1269750
description:
Jan 28 02:47:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.26
country_id: 953987
description:
Jan 28 02:47:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.162.98.112
country_id: 3077311
description:
Jan 28 02:48:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.162.98.112 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.127.248.185
country_id: 3351879
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/taste/8/270/841542 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.240
country_id: 1269750
description:
Jan 28 02:55:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.36
country_id: 2300660
description:
Jan 28 02:56:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.127
country_id: 953987
description:
Jan 28 02:56:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.127 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.182.222.28
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?product_id=403&route=product/product&tag=d010-0004 - rsc printed carton HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.111
country_id: 1512440
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/2g.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.116.20
country_id: 2921044
description:
[2026-01-28 03:06:48 +0800] info [webmaild] 85.215.116.20 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.140
country_id: 3175395
description:
Jan 28 03:07:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.64.149
country_id: 3469034
description:
Jan 28 03:07:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.64.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.140
country_id: 3175395
description:
Jan 28 03:08:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.140 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.144
country_id: 2635167
description:
2026-01-28  3:09:30 844677 [Warning] Aborted connection 844677 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.144' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.144
country_id: 2635167
description:
2026-01-28  3:12:35 844794 [Warning] Aborted connection 844794 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.144' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.58.59.76
country_id: 1269750
description:
2026-01-28 03:13:25 dovecot_plain authenticator failed for H=(1VT5KO7) [152.58.59.76]:52022: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.141.242
country_id: 99237
description:
Jan 28 03:14:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.141.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.106.80.94
country_id: 3469034
description:
Jan 28 03:15:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.106.80.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.141.242
country_id: 99237
description:
Jan 28 03:15:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.141.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.185.159
country_id: 3469034
description:
Jan 28 03:15:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.185.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.185.159
country_id: 3469034
description:
Jan 28 03:16:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.185.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 03:17:04 H=([46.151.182.48]) [46.151.182.48]:55055 F=<cpanel@fasterget.com.my> rejected RCPT <operation2@fasterget.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/component/tag/images/img/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/img/photos/csr.php||SC:/home/indfinitydesign/public_html/img/photos/img||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 67.205.174.40
country_id: 6252001
description:
2026-01-28  3:20:55 845178 [Warning] Aborted connection 845178 to db: 'unconnected' user: 'unauthenticated' host: '67.205.174.40' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.169.9
country_id: 6252001
description:
2026-01-28  3:20:57 845183 [Warning] Aborted connection 845183 to db: 'unconnected' user: 'unauthenticated' host: '159.223.169.9' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.144
country_id: 2635167
description:
2026-01-28  3:24:33 845343 [Warning] Aborted connection 845343 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.144' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 03:26:15 H=([46.151.182.48]) [46.151.182.48]:64977 F=<cpanel@ktlog.com.my> rejected RCPT <stacy@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.202.35.161
country_id: 1831722
description:
[2026-01-28 03:27:01 +0800] info [cpaneld] 160.202.35.161 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 03:27:57 H=([46.151.182.48]) [46.151.182.48]:52595 F=<cpanel@empirelog.com.my> rejected RCPT <waynegoh@empirelog.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-28 03:32:00 H=([62.60.130.227]) [62.60.130.227]:55924 F=<no-reply@setmore.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from setmore.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.173.204.141
country_id: 1269750
description:
Jan 28 03:31:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.173.204.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.173.204.141
country_id: 1269750
description:
2026-01-28 03:31:31 dovecot_plain authenticator failed for H=(namschpij83eiqgg54z29ad) [103.173.204.141]:39206: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.90
country_id: 3469034
description:
Jan 28 03:33:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.169
country_id: 3175395
description:
Jan 28 03:34:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.169 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.220.248
country_id: 1562822
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/landscape HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.124.1
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=658383 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.189
country_id: 3469034
description:
Jan 28 03:40:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.246.238
country_id: 1814991
description:
Jan 28 03:40:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.246.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-01-28 03:40:35 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:39586: 535 Incorrect authentication data (set_id=info@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 03:45:55 H=([46.151.182.48]) [46.151.182.48]:55813 F=<cpanel@ktlog.com.my> rejected RCPT <cklee@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.125
country_id: 6252001
description:
2026-01-28  3:47:47 846181 [Warning] Aborted connection 846181 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.125' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.71
country_id: 690791
description:
Jan 28 03:47:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.71
country_id: 690791
description:
Jan 28 03:48:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.235
country_id: 3469034
description:
Jan 28 03:48:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 03:48:50 H=([46.151.182.48]) [46.151.182.48]:62005 F=<cpanel@ktlog.com.my> rejected RCPT <eunice.lee@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.239.45.10
country_id: 1269750
description:
Jan 28 03:50:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.239.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.160
country_id: 3175395
description:
Jan 28 03:58:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.160 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 223.29.253.157
country_id: 1814991
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-59.223.29.253.157||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.160
country_id: 3175395
description:
Jan 28 03:59:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.253.71
country_id: 3469034
description:
Jan 28 03:59:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.253.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-28 03:59:23 H=([77.83.39.188]) [77.83.39.188]:36971 F=<info@bimaco-grupa.com> rejected RCPT <kasim_kn@ajplantations.com.my>: SPF: 77.83.39.188 is not allowed to send mail from bimaco-grupa.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.59
country_id: 3469034
description:
Jan 28 04:00:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.246.198
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-07.144.124.246.198||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-28 04:08:24 H=([46.151.182.48]) [46.151.182.48]:65184 F=<cpanel@cordage.com.my> rejected RCPT <sales@cordage.com.my>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.114.25.202
country_id: 1282988
description:
[2026-01-28 04:08:39 +0800] info [whostmgrd] 103.114.25.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.194.168.249
country_id: 3469034
description:
[2026-01-28 04:08:48 +0800] info [whostmgrd] 186.194.168.249 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.22
country_id: 226074
description:
Jan 28 04:11:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/about.php||SC:/home/indfinitydesign/public_html/img/photos/about.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.15
country_id: 2635167
description:
Jan 28 04:13:16 sv3 pure-ftpd[3231744]: (?@185.247.137.15) [INFO] New connection from 185.247.137.15


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.137.8.40
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ice/12/146/1256895 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Jan 28 04:19:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-28 04:19:21 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:60466: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.249
country_id: 3469034
description:
Jan 28 04:19:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.229
country_id: 3469034
description:
Jan 28 04:19:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.229 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.243.213.4
country_id: 2017370
description:
[2026-01-28 04:20:40 +0800] info [cpaneld] 94.243.213.4 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.145.166.183
country_id: 2542007
description:
[2026-01-28 04:20:47 +0800] info [cpaneld] 197.145.166.183 - ww "GET /login/?login_only=1&user=ww&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ww (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.41.238.24
country_id: 286963
description:
[2026-01-28 04:20:43 +0800] info [cpaneld] 37.41.238.24 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.4.127
country_id: 2542007
description:
[2026-01-28 04:20:45 +0800] info [cpaneld] 105.155.4.127 - www "GET /login/?login_only=1&user=www&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user www (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.101.184.68
country_id: 953987
description:
[2026-01-28 04:20:38 +0800] info [cpaneld] 197.101.184.68 - wwwagpcorgmy "GET /login/?login_only=1&user=wwwagpcorgmy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wwwagpcorgmy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.48.168.35
country_id: 1733045
description:
[2026-01-28 04:26:04 +0800] info [cpaneld] 60.48.168.35 - agpcorgmy "GET /login/?login_only=1&user=agpcorgmy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpcorgmy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.171.206.109
country_id: 99237
description:
[2026-01-28 04:26:06 +0800] info [cpaneld] 83.171.206.109 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.36.143
country_id: 3895114
description:
[2026-01-28 04:26:09 +0800] info [cpaneld] 190.114.36.143 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.73.184.82
country_id: 290557
description:
[2026-01-28 04:26:10 +0800] info [cpaneld] 91.73.184.82 - agpc "GET /login/?login_only=1&user=agpc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.38.210.119
country_id: 2921044
description:
[2026-01-28 04:26:12 +0800] info [cpaneld] 91.38.210.119 - agp "GET /login/?login_only=1&user=agp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.233.31.54
country_id: 3865483
description:
[2026-01-28 04:26:15 +0800] info [cpaneld] 170.233.31.54 - ag "GET /login/?login_only=1&user=ag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ag (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.173
country_id: 6252001
description:
Jan 28 04:31:18 sv3 pure-ftpd[3246670]: (?@167.94.138.173) [INFO] New connection from 167.94.138.173


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.189.211
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/33chartcreate-scatter.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.15.248
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/DebugHandlersListener.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.94
country_id: 3469034
description:
Jan 28 04:37:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.153
country_id: 953987
description:
Jan 28 04:37:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.153
country_id: 953987
description:
Jan 28 04:38:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.242.102
country_id: 1269750
description:
Jan 28 04:38:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.242.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.213
country_id: 3469034
description:
Jan 28 04:40:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.12.133.18
country_id: 3865483
description:
Jan 28 04:40:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.12.133.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.88.146
country_id: 1861060
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/img/photos/6250854050.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.51.249
country_id: 390903
description:
[2026-01-28 04:46:14 +0800] info [webmaild] 45.74.51.249 - chew@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jan 28 05:01:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.78.255.88
country_id: 1210997
domain: webhosting2u.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/webhosting2u.com/masaaki/about/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.61
country_id: 3996063
description:
Jan 28 05:04:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.114.228
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=934113 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.78.250
country_id: 690791
description:
Jan 28 05:10:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.78.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.217.104.253
country_id: 2077456
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/product/Barb Wire.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/images/about.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.128
country_id: 3469034
description:
Jan 28 05:18:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.128
country_id: 3469034
description:
Jan 28 05:19:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.128 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.225.87.232
country_id: 1814991
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/supyogamalaysia-howtogetthere.htm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 220.154.134.114
country_id: 1814991
description:
2026-01-28 05:21:08 H=([220.154.134.114]) [220.154.134.114]:56800 F=<dse_NA2@docusign.net> rejected RCPT <suffian@pspoly.com.my>: SPF: 220.154.134.114 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.96.89.130
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-23.172.96.89.130||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.197.174
country_id: 1269750
description:
Jan 28 05:24:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.197.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jan 28 05:24:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.246.198
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-26.144.124.246.198||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/img/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.43
country_id: 2300660
description:
Jan 28 05:29:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
country_id: 1269750
description:
Jan 28 05:29:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.43
country_id: 2300660
description:
Jan 28 05:30:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.101.88.202
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/wing/15/511/1590425 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.186.237
country_id: 2510769
description:
Jan 28 05:30:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.183.186.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.89.69.123
country_id: 2328926
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/league/flysystem/src/Adapter/Local.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 28 05:31:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.201.199.153
country_id: 1880251
description:
Jan 28 05:31:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.201.199.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jan 28 05:32:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.26.31.62
country_id: 1814991
description:
Jan 28 05:34:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.26.31.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.21.208.55
country_id: 6252001
description:
Jan 28 05:34:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.21.208.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.6.143.98
country_id: 1605651
description:
Jan 28 05:34:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.6.143.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jan 28 05:35:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 37.19.223.218
country_id: 2782113
domain: www.modern.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/contact-us/||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.19.223.218
country_id: 2782113
domain: www.modern.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-37.37.19.223.218||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.42
country_id: 3175395
description:
Jan 28 05:40:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.60
country_id: 798544
description:
Jan 28 05:40:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.42
country_id: 3175395
description:
Jan 28 05:41:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.15.113.142
country_id: 1605651
description:
2026-01-28 05:41:39 H=([209.15.113.142]) [209.15.113.142]:53994 F=<voicemail@serverdata.net> rejected RCPT <jle@ajplantations.com.my>: SPF: 209.15.113.142 is not allowed to send mail from serverdata.net


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.49.249.39
country_id: 3175395
description:
Jan 28 05:44:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.49.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.141
country_id: 1269750
description:
Jan 28 05:45:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.141
country_id: 1269750
description:
Jan 28 05:46:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 28 05:48:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-28 05:48:56 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:42682: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.27
country_id: 953987
description:
Jan 28 05:49:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.140.231
country_id: 690791
description:
Jan 28 05:50:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.140.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.60.59.50
country_id: 6254930
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/high/18/43/1830260 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.109.97
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=76741515043684 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.251.251.108
country_id: 1819730
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/2343902730.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.204.8
country_id: 2413451
description:
Jan 28 05:59:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.204.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.94
country_id: 3469034
description:
Jan 28 06:00:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.7.22.183
country_id: 1605651
description:
Jan 28 06:00:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.7.22.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.94.178.111
country_id: 6252001
description:
Jan 28 06:00:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.94.178.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.94
country_id: 3469034
description:
Jan 28 06:01:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.73.188
country_id: 6252001
description:
Jan 28 06:01:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.73.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.181
country_id: 3469034
description:
Jan 28 06:02:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.213.248.189
country_id: 1269750
description:
Jan 28 06:03:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.213.248.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.222.117.178
country_id: 1269750
description:
Jan 28 06:03:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.222.117.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-28 06:07:48 H=([77.83.39.188]) [77.83.39.188]:30908 F=<info@bimaco-grupa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-28 06:09:00 H=([77.83.39.188]) [77.83.39.188]:34685 F=<info@bimaco-grupa.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.188 is not allowed to send mail from bimaco-grupa.com


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-28  6:13:06 851857 [Warning] Aborted connection 851857 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.162.102.126
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/test/fixtures/config.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 170.0.34.95
country_id: 3469034
description:
2026-01-28  6:19:14 852072 [Warning] Aborted connection 852072 to db: 'unconnected' user: 'unauthenticated' host: '170.0.34.95' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 170.0.34.95
country_id: 3469034
description:
2026-01-28  6:19:23 852096 [Warning] Aborted connection 852096 to db: 'unconnected' user: 'unauthenticated' host: '170.0.34.95' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.15.113.142
country_id: 1605651
description:
2026-01-28 06:20:06 H=([209.15.113.142]) [209.15.113.142]:55236 F=<voicemail@serverdata.net> rejected RCPT <info@pftfood.com>: SPF: 209.15.113.142 is not allowed to send mail from serverdata.net


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.7
country_id: 690791
description:
2026-01-28 06:21:44 H=([45.144.212.7]) [45.144.212.7]:53040 F=<nirob@zasafashioncreation1.com> rejected RCPT <sales@wcc.com.my>: Rejected relay attempt: '45.144.212.7' From: 'nirob@zasafashioncreation1.com' To: 'sales@wcc.com.my'


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.0.18.139
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/vlucas/phpdotenv/src/Exception/ValidationException.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/home/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.105.61
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-22.50.117.105.61||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.72.217
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-23.142.111.72.217||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 170.0.34.95
country_id: 3469034
description:
2026-01-28  6:24:27 852365 [Warning] Aborted connection 852365 to db: 'unconnected' user: 'unauthenticated' host: '170.0.34.95' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.33.224
country_id: 2750405
description:
Jan 28 06:26:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.33.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.224
country_id: 2750405
description:
2026-01-28 06:27:01 dovecot_login authenticator failed for H=(ADMIN) [84.54.33.224]:32964: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.90
country_id: 953987
description:
Jan 28 06:27:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 217.182.77.22
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/photos/img/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.223.215
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/case/56/328062 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:42:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.222
country_id: 6252001
description:
Jan 28 06:42:45 sv3 pure-ftpd[3336902]: (?@198.235.24.222) [INFO] New connection from 198.235.24.222


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.54.205.44
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/yaml/phpunit.xml.dist HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:43:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:45:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/pcp-conf.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:48:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:49:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 46.246.92.216
country_id: 2661886
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3904.40 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:51:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.67.148.188
country_id: 3996063
description:
2026-01-28 06:52:22 dovecot_plain authenticator failed for H=([127.0.1.1]) [69.67.148.188]:8908: 535 Incorrect authentication data (set_id=rnd)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.94.216.12
country_id: 6252001
description:
[2026-01-28 06:53:47 +0800] info [webmaild] 138.94.216.12 - kelveen@tst-ma.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.15.247.107
country_id: 2510769
description:
[2026-01-28 06:53:48 +0800] info [webmaild] 45.15.247.107 - tst-ma@tst-ma.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.9.7
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/clients.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:53:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.29.74.163
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-54.64.29.74.163||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:54:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:56:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.239.45.10
country_id: 1269750
description:
Jan 28 06:57:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.239.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.242.40
country_id: 1269750
description:
Jan 28 06:58:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.242.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.218
country_id: 1269750
description:
Jan 28 06:58:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.204.8
country_id: 2413451
description:
Jan 28 06:58:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.204.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 06:59:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.137.46
country_id: 1269750
description:
Jan 28 06:59:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.137.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.81.104.127
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=435053 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:00:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 28 07:01:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:02:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:04:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:05:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.218.44
country_id: 2245662
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hard/16/301/1648206 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:07:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:10:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:11:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.14.175
country_id: 1562822
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/11b3b0cb-106d-4cf8-be99-09213e6d7290.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.114.42.177
country_id: 3895114
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/fea7a6a9-21c7-4ccf-8d18-95d6bd1644be.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.121.202.77
country_id: 3469034
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/45de2c5f-a93b-4d83-a59e-9b5cdb55aab5.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:13:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-28 07:15:45 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:49132: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:15:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 28 07:15:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:16:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:18:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.92.138.215
country_id: 1643084
description:
Jan 28 07:19:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.92.138.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.89.52.207
country_id: 2017370
description:
Jan 28 07:19:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.89.52.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.89.52.207
country_id: 2017370
description:
2026-01-28 07:19:07 dovecot_plain authenticator failed for H=theenth.ru (DESKTOP-22EVPBQ) [45.89.52.207]:38566: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.99
country_id: 690791
description:
2026-01-28 07:19:13 H=([77.83.39.99]) [77.83.39.99]:62417 F=<info@landgest.com> rejected RCPT <celine@ktlog.com.my>: SPF: 77.83.39.99 is not allowed to send mail from landgest.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.30.226
country_id: 226074
description:
Jan 28 07:20:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.30.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:21:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.126
country_id: 3469034
description:
Jan 28 07:21:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.198
country_id: 3175395
description:
Jan 28 07:21:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.198
country_id: 3175395
description:
Jan 28 07:22:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:22:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.233
country_id: 3175395
description:
Jan 28 07:24:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.132
country_id: 953987
description:
Jan 28 07:24:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:24:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.233
country_id: 3175395
description:
Jan 28 07:25:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.146.105
country_id: 690791
description:
Jan 28 07:26:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.146.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.222
country_id: 3469034
description:
Jan 28 07:26:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:26:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.15.123
country_id: 3469034
description:
Jan 28 07:26:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.15.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.99
country_id: 2300660
description:
Jan 28 07:26:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.219
country_id: 3175395
description:
Jan 28 07:26:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.235.151
country_id: 3175395
description:
Jan 28 07:26:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.17
country_id: 3175395
description:
Jan 28 07:26:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.111.94
country_id: 6290252
description:
Jan 28 07:26:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.111.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.30
country_id: 732800
description:
Jan 28 07:26:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.111
country_id: 3175395
description:
Jan 28 07:26:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.190
country_id: 1269750
description:
Jan 28 07:26:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.15.123
country_id: 3469034
description:
Jan 28 07:27:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.15.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.99
country_id: 2300660
description:
Jan 28 07:27:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:27:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.95.10
country_id: 3469034
description:
Jan 28 07:29:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.95.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.95.10
country_id: 3469034
description:
2026-01-28 07:29:20 dovecot_plain authenticator failed for H=(398XN2FAL8) [45.182.95.10]:49466: 535 Incorrect authentication data (set_id=cindy.mak@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.20.252
country_id: 1733045
description:
2026-01-28 07:30:37 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.20.252]:51393: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:30:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.20.252
country_id: 1733045
description:
2026-01-28 07:30:58 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.20.252]:51421: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.20.252
country_id: 1733045
description:
2026-01-28 07:32:30 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.20.252]:51412: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 182.62.20.252
country_id: 1733045
description:
2026-01-28 07:32:57 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.20.252]:51386: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:32:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.20.252
country_id: 1733045
description:
2026-01-28 07:33:01 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.20.252]:51407: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:33:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.46.65.217
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-33.69.46.65.217||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.115.50.92
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Encryption HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.183.10.209
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Encryption/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:35:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.218
country_id: 3469034
description:
Jan 28 07:36:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:37:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:38:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.94.178.111
country_id: 6252001
description:
Jan 28 07:39:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.94.178.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.242.52.27
country_id: 1269750
description:
Jan 28 07:40:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.242.52.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:41:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.68
country_id: 1269750
description:
Jan 28 07:42:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/img/contact.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.21.14.144
country_id: 3175395
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-43.82.21.14.144||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:43:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:44:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:46:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 28 07:48:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:48:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:50:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.94.178.111
country_id: 6252001
description:
Jan 28 07:51:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.94.178.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:52:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:54:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.149.43
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/about-us/images/resource/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 202.184.55.92
country_id: 1733045
description:
[2026-01-28 07:54:44 +0800] info [cpaneld] 202.184.55.92 - indfinitydesign "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:55:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:57:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 07:59:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:01:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.142.148.1
country_id: 1733045
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=31521514876508 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:03:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.52
country_id: 690791
description:
2026-01-28 08:05:23 H=([45.144.212.52]) [45.144.212.52]:56399 F=<shassan@rsms.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.52 is not allowed to send mail from rsms.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:05:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:06:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.87.33.87
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=471602 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:08:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:11:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:12:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.182
country_id: 3469034
description:
Jan 28 08:12:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.12.118.74
country_id: 3469034
description:
Jan 28 08:12:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.12.118.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.149.159
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=13701514857901 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.237
country_id: 3469034
description:
Jan 28 08:13:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.141.129
country_id: 1733045
description:
[2026-01-28 08:13:55 +0800] info [webmaild] 113.211.141.129 - s-osada@mckd.com.my "GET /cpsess8171399154/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.80
country_id: 3469034
description:
Jan 28 08:14:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:14:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.141.129
country_id: 1733045
description:
[2026-01-28 08:14:00 +0800] info [webmaild] 113.211.141.129 - s-osada@mckd.com.my "GET /cpsess0609752965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-28 08:15:31 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:37095: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.117.44.239
country_id: 2510769
description:
Jan 28 08:15:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.117.44.239 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.53
country_id: 6252001
description:
2026-01-28  8:16:14 856109 [Warning] Aborted connection 856109 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.53' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:16:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
country_id: 1835841
description:
Jan 28 08:16:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:17:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.191
country_id: 3469034
description:
Jan 28 08:18:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.193.127
country_id: 1814991
description:
Jan 28 08:18:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.193.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.19.198.243
country_id: 6252001
description:
Jan 28 08:18:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.19.198.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.198.243
country_id: 6252001
description:
2026-01-28 08:18:02 dovecot_plain authenticator failed for H=(DESKTOP-22EVPBQ) [37.19.198.243]:34796: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.85
country_id: 3469034
description:
Jan 28 08:18:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:19:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.0.32
country_id: 1269750
domain: rcct.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:89412.rcct.my||ServerName:rcct.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5e396408e3171149cb85d27e273ac050c30efdca||Title:0x1f08dfd3||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.179.39.42
country_id: 6252001
description:
[2026-01-28 08:21:08 +0800] info [webmaild] 186.179.39.42 - callen@kimmark.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.86.18.79
country_id: 6252001
description:
[2026-01-28 08:21:09 +0800] info [webmaild] 45.86.18.79 - kimmark@kimmark.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.224.202
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=607507 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:22:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:23:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.37.65.178
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/DependencyInjection/MergeExtensionConfigurationPass.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:25:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:27:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.177
country_id: 3469034
description:
Jan 28 08:27:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.7
country_id: 690791
description:
2026-01-28 08:27:19 H=([45.144.212.7]) [45.144.212.7]:59407 F=<unitanker@lttnet.net> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:28:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-28 08:30:11 H=([45.144.212.50]) [45.144.212.50]:65453 F=<info@oceanrichmarine.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from oceanrichmarine.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.61.6.114
country_id: 1269750
description:
2026-01-28 08:30:18 dovecot_login authenticator failed for H=(94.154.35.215) [120.61.6.114]:48752: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:30:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-28 08:31:36 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:33:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-28 08:33:27 +0800] info [webmaild] 203.106.96.63 - infocal@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:34:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.188.37
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-35.171.236.188.37||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:36:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-28 08:36:45 +0800] info [webmaild] 180.75.72.60 - general@smartcable.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.234
country_id: 3469034
description:
Jan 28 08:38:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-28 08:38:58 H=([77.83.39.188]) [77.83.39.188]:59836 F=<info@bimaco-grupa.com> rejected RCPT <sales@cordage.com.my>: SPF: 77.83.39.188 is not allowed to send mail from bimaco-grupa.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:38:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:39:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.105.75.5
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=435053 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.234
country_id: 3469034
description:
Jan 28 08:39:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 151.240.202.166
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-40.151.240.202.166||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.231.162.149
country_id: 3996063
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=4&page_id=1 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:41:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.220.17
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=4&page_id=1&sub=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:44:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:45:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:47:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:49:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:50:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.120.89
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=33 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.20.102
country_id: 3686110
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=784798 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.38.152
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=25 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.33.241
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=30 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.36.41
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=15 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.188.135.254
country_id: 3996063
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=778095 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.92.96
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=562301 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.15.75.75
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=159341 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-28 08:51:41 +0800] info [webmaild] 203.106.96.63 - muslihin@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.56.121
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=539500 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.83.106
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=8 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.38.120
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=434148 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.153.227.78
country_id: 1269750
description:
Jan 28 08:53:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.153.227.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.227.78
country_id: 1269750
description:
2026-01-28 08:53:27 dovecot_login authenticator failed for H=([103.158.231.81]) [103.153.227.78]:8760: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:53:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:55:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:56:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 101.249.62.114
country_id: 1814991
description:
Jan 28 08:56:31 sv3 pure-ftpd[3446959]: (?@101.249.62.114) [INFO] New connection from 101.249.62.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 08:57:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61779: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 08:58:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61810: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 08:58:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:00:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 09:00:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61822: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:02:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.146
country_id: 3865483
description:
Jan 28 09:02:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.201.250.16
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/File/UploadedFile.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 09:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49222: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:04:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.116.20
country_id: 1562822
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/854462.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.79.150.137
country_id: 272103
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/blog/2019/02/images/banner1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.197.42.185
country_id: 3703430
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/blog/2019/02/images/logo.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.39.38.146
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/blog/2019/02/images/logo-(3).png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.248.160
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/blog/2019/02/images/banner2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/radioactive.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.160
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-06.92.71.72.160||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:06:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:07:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:07:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:07:43 dovecot_login authenticator failed for H=(QDarnW0) [185.230.124.69]:49283: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:08:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:08:15 dovecot_login authenticator failed for H=(Yu5ePD) [185.230.124.69]:56358: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:09:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:09:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:09:04 dovecot_login authenticator failed for H=(tm8LR3xc) [185.230.124.69]:52731: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.241.64
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=203673 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.24
country_id: 298795
description:
Jan 28 09:10:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:10:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:10:17 dovecot_login authenticator failed for H=(YU2m0G) [185.230.124.69]:55175: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.89.167.163
country_id: 2635167
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/photos/img/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:11:07 dovecot_login authenticator failed for H=(1edao8l) [185.230.124.69]:60169: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:11:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:11:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:12:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:12:22 dovecot_login authenticator failed for H=(BgsAZRhQ7) [185.230.124.69]:52584: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 09:13:39 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57683: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:13:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:13:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:13:11 dovecot_login authenticator failed for H=(kzxR4WB) [185.230.124.69]:51855: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.165.125.212
country_id: 690791
description:
Jan 28 09:13:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.165.125.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.165.125.212
country_id: 690791
description:
2026-01-28 09:13:34 dovecot_plain authenticator failed for H=(formie) [178.165.125.212]:1054: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:14:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:14:23 dovecot_login authenticator failed for H=(Y8XcD9TL3j) [185.230.124.69]:62502: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:15:16 dovecot_login authenticator failed for H=(7IcJj1shs) [185.230.124.69]:57652: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.250
country_id: 51537
description:
Jan 28 09:15:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:15:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:15:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:16:23 dovecot_login authenticator failed for H=(9egDTR1A) [185.230.124.69]:58204: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.250
country_id: 51537
description:
Jan 28 09:16:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 09:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62541: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:16:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:17:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:17:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:17:06 dovecot_login authenticator failed for H=(4GD3Uk) [185.230.124.69]:62049: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:18:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:18:13 dovecot_login authenticator failed for H=(JedDoSalS) [185.230.124.69]:49699: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:18:37 dovecot_login authenticator failed for H=(CpaIDT7) [185.230.124.69]:49461: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:18:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 09:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62577: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:19:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:19:24 dovecot_login authenticator failed for H=(yWh7xRv) [185.230.124.69]:62628: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:20:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.93.205
country_id: 1643084
description:
[2026-01-28 09:20:46 +0800] info [cpaneld] 95.135.93.205 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:20:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:20:11 dovecot_login authenticator failed for H=(GqIQ1aW8MD) [185.230.124.69]:64064: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:21:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:21:18 dovecot_login authenticator failed for H=(bWNHqlCz) [185.230.124.69]:56623: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 09:21:53 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62620: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:22:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 09:22:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62621: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:22:06 dovecot_login authenticator failed for H=(aPdQjm9Z) [185.230.124.69]:57717: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:23:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:23:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:23:21 dovecot_login authenticator failed for H=(ULvVOv) [185.230.124.69]:56361: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 09:24:43 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62654: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:24:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:24:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:24:08 dovecot_login authenticator failed for H=(3P0bDT) [185.230.124.69]:64502: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:25:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:25:19 dovecot_login authenticator failed for H=(yvFnVmGa) [185.230.124.69]:63099: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 09:25:01 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62655: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:26:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:26:13 dovecot_login authenticator failed for H=(EaIbXzR8n) [185.230.124.69]:58165: 535 Incorrect authentication data (set_id=corporate@krisfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:26:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:28:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:29:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:29:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:29:43 dovecot_login authenticator failed for H=(Mwikh842) [185.230.124.69]:49442: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:30:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:30:13 dovecot_login authenticator failed for H=(ibkOJ3) [185.230.124.69]:49594: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.237.86.217
country_id: 1562822
description:
2026-01-28 09:30:17 H=([103.237.86.217]) [103.237.86.217]:61978 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<sgn.tnguyenchauman@cma-cgm.com> rejected RCPT <jaya@ktlog.com.my>: SPF: 103.237.86.217 is not allowed to send mail from cma-cgm.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 09:30:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57786: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:31:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:31:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:31:01 dovecot_login authenticator failed for H=(CSGSGcYE1T) [185.230.124.69]:59284: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:32:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:32:17 dovecot_login authenticator failed for H=(5Eq9Gx) [185.230.124.69]:51623: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 216.126.239.87
country_id: 6252001
domain: aoto.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/577.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:33:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:33:05 dovecot_login authenticator failed for H=(gClUHYQXti) [185.230.124.69]:58246: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:34:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:34:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:34:12 dovecot_login authenticator failed for H=(x5AimRDd) [185.230.124.69]:60697: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:34:35 dovecot_login authenticator failed for H=(Zqz2LJh) [185.230.124.69]:50208: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.23.236.113
country_id: 1861060
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-35.82.23.236.113||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:35:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:35:25 dovecot_login authenticator failed for H=(dfrCCEY) [185.230.124.69]:57367: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 09:35:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62850: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:35:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.230.124.69
country_id: 2510769
description:
Jan 28 09:36:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.230.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.230.124.69
country_id: 2510769
description:
2026-01-28 09:36:13 dovecot_login authenticator failed for H=(5itHHO) [185.230.124.69]:56474: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:37:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.238
country_id: 1733045
description:
[2026-01-28 09:37:29 +0800] info [webmaild] 27.125.241.238 - jlpom@ajplantations.com.my "POST /cpsess0727283281/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.48.201.131] != Current IP Address [27.125.241.238]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.22
country_id: 690791
description:
Jan 28 09:39:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:39:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:40:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:42:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-28 09:43:49 H=([77.83.39.188]) [77.83.39.188]:51503 F=<info@bimaco-grupa.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.52.137.110
country_id: 1733045
description:
[2026-01-28 09:45:08 +0800] info [webmaild] 60.52.137.110 - salwana@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:45:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-28 09:45:16 H=([45.144.212.54]) [45.144.212.54]:61470 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<events@latinserverhost.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.142.124
country_id: 1733045
description:
[2026-01-28 09:45:35 +0800] info [webmaild] 42.191.142.124 - nazurah@fkr.com.my "GET /cpsess3649793910/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:46:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:48:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.8.107.194
country_id: 2017370
domain: plomalite.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:09-48.46.8.107.194||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.53.226.2
country_id: 357994
description:
[2026-01-28 09:49:02 +0800] info [webmaild] 197.53.226.2 - central@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.156
country_id: 3703430
description:
Jan 28 09:50:21 sv3 pure-ftpd[3538409]: (?@45.227.254.156) [INFO] New connection from 45.227.254.156


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:50:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:51:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.53.226.2
country_id: 357994
description:
[2026-01-28 09:52:38 +0800] info [webmaild] 197.53.226.2 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.22
country_id: 2395170
description:
Jan 28 09:52:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:53:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.22
country_id: 2395170
description:
Jan 28 09:53:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 09:53:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62972: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-28 09:54:21 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:56:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:57:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 09:58:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57870: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 09:59:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-28 10:00:00 H=([127.0.0.1]) [103.197.57.71]:47150 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:01:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:02:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:04:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-28 10:05:10 H=([45.144.212.242]) [45.144.212.242]:51271 F=<no_reply@admin.com> rejected RCPT <emma@agsaintifik.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.122.179.236
country_id: 6252001
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/course/TOEFL-Exam-Preparatory-7 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.159
country_id: 6252001
description:
Jan 28 10:07:51 sv3 pure-ftpd[3567950]: (?@205.210.31.159) [INFO] New connection from 205.210.31.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:07:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 118.100.70.180
country_id: 1733045
description:
[2026-01-28 10:07:23 +0800] info [webmaild] 118.100.70.180 - eejb@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:08:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:10:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:12:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.129.13.59
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maennchen/zipstream-php/src/DeflateStream.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:13:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:16:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:18:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:19:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.194.178.83
country_id: 3017382
domain: nmahir.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:nmahirc||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.101.37.214
country_id: 1269750
description:
2026-01-28 10:20:25 dovecot_plain authenticator failed for H=(56QUULLY) [175.101.37.214]:58254: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:21:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.64.27
country_id: 1733045
description:
[2026-01-28 10:22:23 +0800] info [webmaild] 113.211.64.27 - azlin@indfinitydesign.com "GET /cpsess2085404415/3rdparty/roundcube/index.php?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 10:23:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:63208: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.194.178.58
country_id: 3017382
domain: fkr.com.my
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:fkrcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:23:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.194.178.58
country_id: 3017382
domain: wcc.com.my
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:woh||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:25:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.108.102.6
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dress/14/476/1433641 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 27.42.98.127
country_id: 1814991
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:10-26.27.42.98.127||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 10:26:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57972: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.64.27
country_id: 1733045
description:
[2026-01-28 10:26:28 +0800] info [webmaild] 113.211.64.27 - azlin@indfinitydesign.com "GET /cpsess7785690450/webmail/jupiter/index.html?login=1&post_login=7321647833075 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:27:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-28 10:28:08 H=([45.144.212.50]) [45.144.212.50]:64173 F=<info@oceanrichmarine.com> rejected RCPT <astkua@astlog.com.my>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.125.135.77
country_id: 2782113
description:
2026-01-28 10:29:08 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [147.125.135.77]:62227: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:29:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.64.27
country_id: 1733045
description:
[2026-01-28 10:29:59 +0800] info [webmaild] 113.211.64.27 - azlin@indfinitydesign.com "GET /cpsess2085404415/3rdparty/roundcube/index.php?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.121
country_id: 6252001
description:
Jan 28 10:30:51 sv3 pure-ftpd[3605251]: (?@66.132.153.121) [INFO] New connection from 66.132.153.121


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-28 10:30:03 H=([45.144.212.242]) [45.144.212.242]:65199 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:30:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.194.178.83
country_id: 3017382
domain: usfood.com.my
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:usfoodcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:32:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:34:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.118.40
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=47191514863574 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:36:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.51.233.14
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/rock/734/171486 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:38:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-28 10:38:50 H=([45.144.212.242]) [45.144.212.242]:64099 F=<info@starorganizasyon.com> rejected RCPT <aoto@aoto.com.my>: SPF: 45.144.212.242 is not allowed to send mail from starorganizasyon.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.64.27
country_id: 1733045
description:
[2026-01-28 10:38:54 +0800] info [webmaild] 113.211.64.27 - azlin@indfinitydesign.com "GET /cpsess7785690450/webmail/jupiter/index.html?login=1&post_login=7321647833075 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.96.44.15
country_id: 6252001
domain: www.mckd.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/101.0.4950.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.96.46.165
country_id: 6252001
domain: www.mckd.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4298.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:40:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:41:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-28 10:41:34 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:53763: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.59
country_id: 953987
description:
Jan 28 10:42:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.135.209
country_id: 3469034
description:
Jan 28 10:42:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.135.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:43:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.211.121.62
country_id: 3624060
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Http HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.201.244.229
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Http/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.135.209
country_id: 3469034
description:
Jan 28 10:43:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.135.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.140.111
country_id: 732800
description:
Jan 28 10:43:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.140.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:46:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:47:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-28 10:47:32 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:52186: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:49:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.102.240
country_id: 1733045
description:
[2026-01-28 10:49:14 +0800] info [webmaild] 175.144.102.240 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.62
country_id: 3175395
description:
Jan 28 10:50:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.48
country_id: 933860
description:
Jan 28 10:50:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-28 10:50:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:54060: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.48
country_id: 933860
description:
Jan 28 10:51:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 10:51:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:63680: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:51:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:52:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 10:54:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58063: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:54:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-28 10:56:54 +0800] info [webmaild] 175.136.123.47 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:57:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 10:58:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 28 10:58:30 sv3 pure-ftpd[3658478]: (?@113.211.212.49) [INFO] New connection from 113.211.212.49


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 28 10:58:32 sv3 pure-ftpd[3658478]: (eminent@113.211.212.49) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 10:58:37 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10932: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 28 10:58:48 sv3 pure-ftpd[3658478]: (eminent@113.211.212.49) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1049_CC_Mass_Acq_2026_EDM/images/G3.jpg


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 10:59:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10933: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-28 11:00:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:54013: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:00:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 11:00:37 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:16529: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.255
country_id: 3469034
description:
Jan 28 11:01:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.255 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.83.73.30
country_id: 1814991
description:
2026-01-28 11:01:02 dovecot_plain authenticator failed for H=(e4865hbaj5n8o92oyj20pv5275b81984) [117.83.73.30]:57356: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 11:01:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:16530: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.219.31
country_id: 3865483
description:
Jan 28 11:02:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.219.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:02:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 11:02:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10934: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.255
country_id: 3469034
description:
Jan 28 11:02:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.255 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.59.33
country_id: 2017370
description:
2026-01-28 11:03:39 dovecot_login authenticator failed for H=broadband-109-173-59-33.ip.moscow.rt.ru (94.154.35.215) [109.173.59.33]:35479: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:03:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.115.35.34
country_id: 3865483
description:
2026-01-28 11:03:46 dovecot_login authenticator failed for H=(94.154.35.215) [190.115.35.34]:39009: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.92
country_id: 3469034
description:
Jan 28 11:03:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.92 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.201.126.243
country_id: 1269750
domain: www.cabe.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:5'nvOpzp; AND 1=1 OR (<'\">iKO)),||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-28 11:04:57 H=([45.144.212.54]) [45.144.212.54]:54228 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<events@latinserverhost.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.127.202.31
country_id: 2017370
description:
2026-01-28 11:05:43 dovecot_login authenticator failed for H=(94.154.35.215) [94.127.202.31]:52099: 535 Incorrect authentication data (set_id=mdnaser@grandteknik.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:05:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 11:05:09 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:16539: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 11:06:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10939: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.205.52
country_id: 1733045
description:
2026-01-28 11:07:36 dovecot_plain authenticator failed for H=(smtpclient.apple) [104.28.205.52]:26573: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:08:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:09:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:11:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 130.193.234.234
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/sfObjects.yml HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.7
country_id: 690791
description:
2026-01-28 11:13:37 H=([45.144.212.7]) [45.144.212.7]:60610 F=<maged@mhmgroupservices.com> rejected RCPT <info@pspoly.com.my>: SPF: 45.144.212.7 is not allowed to send mail from mhmgroupservices.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:13:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.213.164
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=844999 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:14:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 11:15:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10940: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:16:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 11:17:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:16551: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-28 11:18:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:59194: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 11:19:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:63765: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:19:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:20:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:22:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 11:22:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58144: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.88
country_id: 3175395
description:
Jan 28 11:24:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:24:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:25:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-28 11:25:30 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:27:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.60.241.175
country_id: 1168579
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/about_overview.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/plug/sms/img/img/contact-us.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:30:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:31:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.244.198.14
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/blue/7/207/727476 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 11:33:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10943: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:33:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.216
country_id: 6252001
description:
2026-01-28 11:33:50 864020 [Warning] Aborted connection 864020 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.216' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 11:35:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:17114: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:35:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.54
country_id: 3175395
description:
Jan 28 11:36:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:36:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.78
country_id: 732800
description:
Jan 28 11:37:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.54
country_id: 3175395
description:
Jan 28 11:37:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.44.111.30
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-38.152.44.111.30||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:39:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 27.125.249.60
country_id: 1733045
description:
Jan 28 11:40:55 sv3 pure-ftpd[3733874]: (manfotp3@27.125.249.60) [NOTICE] /home/manfotp3//public_html/assets/pdf/260127-Sin Chew Daily-Metro Edition_Manforce.pdf uploaded  (334597 bytes, 710.81KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 27.125.249.60
country_id: 1733045
description:
Jan 28 11:41:36 sv3 pure-ftpd[3733874]: (manfotp3@27.125.249.60) [NOTICE] /home/manfotp3//public_html/assets/pdf/260127-SinChew-Daily-Metro-Edition_Manforce.pdf uploaded  (334597 bytes, 1422.36KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.13
country_id: 174982
description:
2026-01-28 11:41:03 dovecot_login authenticator failed for H=(ADMIN) [185.253.160.13]:25705: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:41:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:42:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.178.131.137
country_id: 3996063
domain: www.store.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.store.oxbold.com/cgi-bin HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:44:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:46:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 11:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:63842: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-28 11:48:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:63814: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:48:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 11:50:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58248: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:50:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/img/photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.155
country_id: 732800
description:
Jan 28 11:50:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.155
country_id: 732800
description:
Jan 28 11:50:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.142.79.74
country_id: 2658434
description:
2026-01-28 11:51:48 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [79.142.79.74]:41704: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.73
country_id: 953987
description:
Jan 28 11:52:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.142.79.74
country_id: 2658434
description:
2026-01-28 11:52:11 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [79.142.79.74]:64552: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:52:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:53:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:55:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/monthlyletter/images/knowyourtyre.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:57:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.148.123
country_id: 2077456
description:
2026-01-28 11:57:20 dovecot_login authenticator failed for H=(94.154.35.215) [120.157.148.123]:56020: 535 Incorrect authentication data (set_id=syazwani@sanicarehygiene.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 11:59:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.76.27
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-59.92.71.76.27||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:01:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.142.145
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteSurfaceChart3.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-28 12:02:57 +0800] info [webmaild] 175.142.113.50 - invoicing@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:03:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.198
country_id: 6252001
description:
Jan 28 12:03:40 sv3 pure-ftpd[3771092]: (?@167.94.138.198) [INFO] New connection from 167.94.138.198


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 12:03:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10945: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:04:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-28 12:04:47 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess2961289908/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 12:05:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:17121: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:06:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 28 12:08:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.246.242
country_id: 3865483
description:
Jan 28 12:08:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.246.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:09:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.160
country_id: 1269750
description:
Jan 28 12:10:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:10:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.154.41
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/asia/images/about.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 28 12:11:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:12:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:14:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.149
country_id: 798544
description:
Jan 28 12:14:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.42.128
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-15.142.111.42.128||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.149
country_id: 798544
description:
Jan 28 12:15:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 12:15:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:63910: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:15:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 28 12:15:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-28 12:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:58066: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:17:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.244.218
country_id: 1814991
description:
Jan 28 12:18:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.244.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 12:18:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58325: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 28 12:19:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:20:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:21:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.168
country_id: 1269750
description:
Jan 28 12:22:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 28 12:22:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:23:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:25:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 28 12:26:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.240.12
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=62821516780656 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:26:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.187.57.215
country_id: 1210997
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/css/owl.theme.default.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.205.102
country_id: 1210997
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/js/bootstrap.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.23.78
country_id: 99237
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/css/font-awesome.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.204.210
country_id: 1562822
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/js/waypoints.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.188.182.110
country_id: 3469034
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.12.155
country_id: 1562822
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/vendors/swiper-master/js/swiper.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.243.247
country_id: 1562822
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/css/responsive.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.151.89.178
country_id: 1522867
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/css/slicknav.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.201.68.109
country_id: 3469034
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/vendors/swiper-master/css/swiper.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.190.63
country_id: 3895114
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/js/magnific-popup.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.89.167.163
country_id: 2635167
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/photos/img/demos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:28:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.91.213
country_id: 3996063
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/specialize HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.222.227.205
country_id: 1269750
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/js/jquery.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.143.251.202
country_id: 3617476
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/css/magnific-popup.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.202.6.192
country_id: 3996063
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/css/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.100.33.166
country_id: 1831722
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/vendors/modernizr-js/modernizr.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.214.7.249
country_id: 3996063
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/css/owl.carousel.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.126.165.40
country_id: 3469034
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/js/counterup.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.95.229.85
country_id: 3469034
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/js/jquery.slicknav.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.77.178.49
country_id: 3469034
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/js/main.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.243.24.83
country_id: 3469034
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/fonts/fontawesome-webfont3e6e.woff2?v=4.7.0 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.252.161.207
country_id: 1643084
domain: mail.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.visoft.com.my/js/owl.carousel.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 28 12:30:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.3
country_id: 3175395
description:
Jan 28 12:30:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.90.211
country_id: 2802361
description:
2026-01-28 12:31:12 dovecot_login authenticator failed for H=(ADMIN) [149.22.90.211]:20012: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:31:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.119
country_id: 3175395
description:
Jan 28 12:31:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 12:31:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10948: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.160.182.102
country_id: 953987
description:
Jan 28 12:31:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.160.182.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.140.240.132
country_id: 3469034
description:
Jan 28 12:31:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.140.240.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.3
country_id: 2395170
description:
Jan 28 12:31:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.101
country_id: 1269750
description:
Jan 28 12:32:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:32:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.67
country_id: 3469034
description:
Jan 28 12:32:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 28 12:33:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 12:33:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:17137: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:34:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:36:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:37:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:39:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-28 12:40:08 H=([45.144.212.242]) [45.144.212.242]:58964 F=<no_reply@admin.com> rejected RCPT <info@sutsb.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:42:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.237.86.217
country_id: 1562822
description:
2026-01-28 12:42:33 H=([103.237.86.217]) [103.237.86.217]:58295 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<sgn.tnguyenchauman@cma-cgm.com> rejected RCPT <egtsales@empirelog.com.my>: SPF: 103.237.86.217 is not allowed to send mail from cma-cgm.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 12:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:63976: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-28 12:43:16 H=([45.144.212.242]) [45.144.212.242]:53748 F=<no_reply@admin.com> rejected RCPT <sales@wohcheong.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:43:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-28 12:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:59605: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:45:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 12:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58472: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.3.151
country_id: 2750405
description:
2026-01-28 12:47:48 dovecot_plain authenticator failed for H=([10.26.18.109]) [158.173.3.151]:43806: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:47:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.107.81.222
country_id: 732800
description:
Jan 28 12:47:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.107.81.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.149
country_id: 3469034
description:
Jan 28 12:47:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.3.151
country_id: 2750405
description:
2026-01-28 12:48:01 dovecot_plain authenticator failed for H=([10.26.18.109]) [158.173.3.151]:2232: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-28 12:48:09 H=([77.83.39.187]) [77.83.39.187]:59447 F=<lilian@baseballrolin.com> rejected RCPT <boonpau.tan@tujusetia.my>: No such person at this address."


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:48:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:51:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.198.46
country_id: 6252001
description:
2026-01-28 12:51:16 dovecot_login authenticator failed for H=(ADMIN) [37.19.198.46]:13639: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:53:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.49.77
country_id: 1269750
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=5044 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:54:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-28 12:55:25 H=([77.83.39.187]) [77.83.39.187]:55006 F=<lilian@baseballrolin.com> rejected RCPT <mkadmin@mkmetal.com.my>: No Such User Here"


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:56:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.115
country_id: 2635167
description:
Jan 28 12:57:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.48.2.93
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cheese/9/722/967052 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 12:58:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 12:59:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10954: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:00:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 13:01:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:17152: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.201.25
country_id: 2413451
description:
Jan 28 13:01:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.201.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:02:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.77.84
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=89931515047067 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.117.44.239
country_id: 2510769
description:
Jan 28 13:03:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.117.44.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:04:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.141.88
country_id: 1269750
description:
Jan 28 13:04:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.141.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:05:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.0.46
country_id: 953987
description:
Jan 28 13:06:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.0.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.0.46
country_id: 953987
description:
Jan 28 13:07:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.0.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:07:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.32.55
country_id: 3469034
description:
Jan 28 13:08:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.32.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.2.46.159
country_id: 1643084
description:
Jan 28 13:08:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.2.46.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.117.178.90
country_id: 2510769
description:
Jan 28 13:08:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.117.178.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.117.178.90
country_id: 2510769
description:
Jan 28 13:09:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.117.178.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 13:09:34 H=([10.1.1.140]) [60.54.167.90]:49184 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:10:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.192
country_id: 1269750
description:
Jan 28 13:11:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 13:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:64033: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:11:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.2.199
country_id: 953987
description:
Jan 28 13:11:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-28 13:12:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:61487: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.53
country_id: 3865483
description:
2026-01-28 13:12:53 dovecot_login authenticator failed for H=(ADMIN) [146.70.38.53]:33293: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:13:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.11.122.75
country_id: 3469034
description:
Jan 28 13:13:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.11.122.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 13:14:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58547: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:15:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:16:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 140.233.179.184
country_id: 2017370
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/2460079596.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:18:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.177
country_id: 3469034
description:
Jan 28 13:18:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.119.196
country_id: 732800
description:
Jan 28 13:18:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.119.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 13:20:10 H=([10.1.1.140]) [60.54.167.90]:49398 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:21:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:22:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 13:22:47 H=([10.1.1.140]) [60.54.167.90]:49408 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:24:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.122
country_id: 6252001
description:
Jan 28 13:25:30 sv3 pure-ftpd[3886936]: (?@66.132.153.122) [INFO] New connection from 66.132.153.122


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-28 13:26:37 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:26:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 13:27:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10961: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:27:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.196.79.138
country_id: 1269750
domain: sutsb.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:25010.sutsb.com.my||ServerName:sutsb.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:082d7838141fcd63de407ab7e6eaaa8af81fdff1||Title:0x06f30e3b||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.159
country_id: 3175395
description:
Jan 28 13:28:30 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 13:29:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:17161: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:29:50 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.212.243
country_id: 1733045
description:
[2026-01-28 13:31:38 +0800] info [webmaild] 113.211.212.243 - lowts@lvconsult.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-28 13:31:58 H=([77.83.39.187]) [77.83.39.187]:62903 F=<lilian@baseballrolin.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:32:11 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.198.179.211
country_id: 1694008
domain: symphony-led.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:77760.symphony-led.com||ServerName:symphony-led.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0d0f2e4284bb904b06eab7e453a2b60788b0af9a||Title:0xb20ce246||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:33:18 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jan 28 13:33:27 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.35
country_id: 1269750
description:
Jan 28 13:33:47 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 13:34:38 H=([10.1.1.140]) [60.54.167.90]:49428 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-28 13:34:51 H=([45.144.212.242]) [45.144.212.242]:49760 F=<no_reply@admin.com> rejected RCPT <ind@indfinitydesign.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.225.78
country_id: 1269750
description:
Jan 28 13:34:59 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.225.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 13:35:05 H=([10.1.1.140]) [60.54.167.90]:49445 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.225.78
country_id: 1269750
description:
Jan 28 13:35:07 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.225.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:35:22 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.36
country_id: 2589581
description:
2026-01-28 13:36:00 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.36]:49940: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 13:36:00 H=([10.1.1.140]) [60.54.167.90]:49457 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.217.104
country_id: 3469034
description:
Jan 28 13:37:46 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.217.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.208
country_id: 3469034
description:
Jan 28 13:37:12 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.208 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.62.252.12
country_id: 1733045
description:
[2026-01-28 13:37:34 +0800] info [webmaild] 182.62.252.12 - sayithiy@ajresorts.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.89.216.67
country_id: 3469034
description:
Jan 28 13:37:34 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.89.216.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:37:43 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.250
country_id: 2300660
description:
Jan 28 13:37:46 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.217.104
country_id: 3469034
description:
Jan 28 13:38:01 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.217.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 43.206.208.110
country_id: 1861060
domain: usfood.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:38:50 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.250
country_id: 2300660
description:
Jan 28 13:38:01 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.60
country_id: 798544
description:
Jan 28 13:38:20 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.167.90
country_id: 1733045
description:
[2026-01-28 13:38:04 +0800] info [webmaild] 60.54.167.90 - jasonkua@printspecsolution.com "GET /cPanel_magic_revision_0/webmail/jupiter/account_preferences/index.min.css HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 13:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:64091: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.64.27
country_id: 1733045
description:
[2026-01-28 13:39:09 +0800] info [webmaild] 113.211.64.27 - azlin@indfinitydesign.com "GET /cpsess2085404415/3rdparty/roundcube/index.php?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 182.62.252.12
country_id: 1733045
description:
[2026-01-28 13:39:45 +0800] info [webmaild] 182.62.252.12 - sayuthiy@ajresorts.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.64.27
country_id: 1733045
description:
[2026-01-28 13:40:29 +0800] info [webmaild] 113.211.64.27 - azlin@indfinitydesign.com "GET /cpsess2622954474/webmail/jupiter/index.html?login=1&post_login=95425802296661 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:40:54 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.185.190
country_id: 1733045
description:
[2026-01-28 13:41:59 +0800] info [webmaild] 115.164.185.190 - teressa@smartcable.com.my "POST /cpsess3909961574/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [180.75.72.60] != Current IP Address [115.164.185.190]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 13:42:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58729: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.84
country_id: 798544
description:
Jan 28 13:42:13 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.84 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.167.90
country_id: 1733045
description:
[2026-01-28 13:43:55 +0800] info [webmaild] 60.54.167.90 - jasonkua@printspecsolution.com "GET /cPanel_magic_revision_0/webmail/jupiter/mail/spam/index.min.css HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:43:15 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.181
country_id: 99237
description:
Jan 28 13:44:13 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:44:21 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.116.129
country_id: 3469034
description:
Jan 28 13:44:33 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.116.129 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.54.167.90
country_id: 1733045
description:
[2026-01-28 13:45:34 +0800] info [cpaneld] 60.54.167.90 - printspec "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user printspec (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-28 13:45:35 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 13:46:04 H=([10.1.1.140]) [60.54.167.90]:49576 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:46:26 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:48:46 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 13:48:53 H=([10.1.1.140]) [60.54.167.90]:49605 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 13:49:09 H=([10.1.1.140]) [60.54.167.90]:49608 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:49:53 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:51:58 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 200.10.47.230
country_id: 1605651
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-53.200.10.47.230||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-28 13:53:46 +0800] info [webmaild] 60.50.199.9 - accountbm@tst-ma.com "POST /cpsess6780404135/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.50.0.217] != Current IP Address [60.50.199.9]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:54:19 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 13:55:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10965: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:55:26 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:57:31 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.154.236
country_id: 1269750
description:
Jan 28 13:57:32 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.154.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 13:57:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:17165: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.51.201
country_id: 3175395
description:
Jan 28 13:57:11 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.51.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.31.145.93
country_id: 798544
description:
Jan 28 13:58:02 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.31.145.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-28 13:58:41 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 13:59:51 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 14:00:22 H=([10.1.1.180]) [60.54.167.90]:49640 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:00:58 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.215.12
country_id: 1733045
description:
[2026-01-28 14:01:30 +0800] info [webmaild] 113.211.215.12 - vincent_tan@mckd.com.my "GET /cpsess5714871245/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.123.55] != Current IP Address [113.211.215.12]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.159
country_id: 690791
description:
Jan 28 14:02:50 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.115
country_id: 2635167
description:
Jan 28 14:02:05 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:03:02 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.159
country_id: 690791
description:
Jan 28 14:03:04 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.252.101.32
country_id: 298795
description:
Jan 28 14:03:21 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.252.101.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:05:23 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 91.238.181.95
country_id: 3017382
description:
2026-01-28 14:05:23 870078 [Warning] Aborted connection 870078 to db: 'unconnected' user: 'unauthenticated' host: '91.238.181.95' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:06:30 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 14:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:64327: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:08:34 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.248.47.121
country_id: 2542007
description:
[2026-01-28 14:09:33 +0800] info [cpaneld] 41.248.47.121 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:10:54 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 14:10:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58850: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.200
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/fontawesome/css/font-awesome.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.238
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/bxslider/jquery.bxslider.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.146
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/animations/animate.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.236
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/fancybox/jquery.fancybox.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.209
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/vendor/rs-plugin/css/settings.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.160
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/revolutionslider/css/settings.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.221
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/miuiconfont/miuiconfont.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.158
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/css/pages-style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.190
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/css/custom.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.193
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/ytplayer/css/YTPlayer.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:12:02 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.167
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/vendor/rs-plugin/css/navigation.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.227.30.164
country_id: 3469034
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/about-us.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.222
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/css/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:14:06 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mkmadmin@mkmetal.com.my [01/28/2026:06:15:47 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mkmadmin@mkmetal.com.my


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.27.42
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=435578 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.107.104.227
country_id: 1819730
description:
2026-01-28 14:15:33 dovecot_login authenticator failed for H=(ADMIN) [86.107.104.227]:35748: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:16:27 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:17:34 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:19:38 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:21:58 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 134.209.77.178
country_id: 6252001
description:
2026-01-28 14:21:05 870548 [Warning] Aborted connection 870548 to db: 'unconnected' user: 'unauthenticated' host: '134.209.77.178' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 68.183.16.91
country_id: 6252001
description:
2026-01-28 14:21:06 870549 [Warning] Aborted connection 870549 to db: 'unconnected' user: 'unauthenticated' host: '68.183.16.91' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.157.0
country_id: 6252001
description:
2026-01-28 14:21:06 870550 [Warning] Aborted connection 870550 to db: 'unconnected' user: 'unauthenticated' host: '159.223.157.0' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 14:23:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10970: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:23:06 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.161.49.181
country_id: 1269750
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=9481 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 14:25:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:17170: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:25:11 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
42.0.28.25 - info@mkmetal.com.my [01/28/2026:06:27:12 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@mkmetal.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:27:31 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - test1@mkmetal.com.my [01/28/2026:06:28:15 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: test1@mkmetal.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:28:38 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:30:42 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - test1@mkmetal.com.my [01/28/2026:06:30:16 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: test1@mkmetal.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.115
country_id: 2635167
description:
Jan 28 14:30:05 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.115 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.125.245.9
country_id: 1733045
description:
27.125.245.9 - - [28/Jan/2026:14:32:59 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7249257&pdata=https%253A%252F%252Fmail.chs.com.my%253A2096%252Fcpsess7906259342%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_mbox%253DINBOX&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769581977 HTTP/2.0" 302 0 mail.chs.com.my "https://mail.chs.com.my:2096/cpsess7906259342/3rdparty/roundcube/?_task=mail&_mbox=INBOX" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.125.245.9


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:33:02 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:34:10 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 14:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:64483: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:36:14 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.38
country_id: 226074
description:
Jan 28 14:36:53 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-28 14:37:34 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.20
country_id: 1821275
description:
2026-01-28 14:37:43 dovecot_login authenticator failed for H=(ADMIN) [84.252.92.20]:52133: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.180
country_id: 298795
description:
Jan 28 14:37:48 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.38
country_id: 226074
description:
Jan 28 14:37:01 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 14:38:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59000: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:38:35 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.180
country_id: 298795
description:
Jan 28 14:38:01 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:39:42 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:41:46 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:44:06 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:45:14 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.245.213
country_id: 1733045
description:
[2026-01-28 14:45:32 +0800] info [webmaild] 27.125.245.213 - cmchin@chs.com.my "GET /cpsess7906259342/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D1%2Cwebp%3D1%2Cpgpmime%3D0&_uid=10899&_mbox=INBOX&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.245.9] != Current IP Address [27.125.245.213]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.125.245.213
country_id: 1733045
description:
27.125.245.213 - - [28/Jan/2026:14:45:32 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776942&pdata=https%253A%252F%252Fmail.chs.com.my%253A2096%252Fcpsess7906259342%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_caps%253Dpdf%25253D1%25252Cflash%25253D0%25252Ctiff%25253D1%25252Cwebp%25253D1%25252Cpgpmime%25253D0%2526_uid%253D10899%2526_mbox%253DINBOX%2526_framed%253D1%2526_action%253Dpreview&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769582731 HTTP/2.0" 302 0 mail.chs.com.my "https://mail.chs.com.my:2096/cpsess7906259342/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D1%2Cwebp%3D1%2Cpgpmime%3D0&_uid=10899&_mbox=INBOX&_framed=1&_action=preview" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Safari/605.1.15" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.125.245.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:47:18 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 14:51:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:10974: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.52
country_id: 690791
description:
2026-01-28 14:51:31 H=([45.144.212.52]) [45.144.212.52]:63381 F=<capt2@waterlinkpak.com> rejected RCPT <astkua@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:52:50 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 14:53:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:17734: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.247
country_id: 953987
description:
Jan 28 14:54:02 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.76.88
country_id: 732800
description:
Jan 28 14:54:23 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.76.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:55:10 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-28 14:55:59 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:56:18 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 14:58:22 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 14:59:13 H=([10.1.1.180]) [60.54.167.90]:49776 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.32.134
country_id: 3865483
description:
Jan 28 14:59:40 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.32.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 144.172.117.220
country_id: 6252001
domain: sv3.nocser.net
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/000000000000.cfg||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:00:42 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.200.242.193
country_id: 690791
description:
Jan 28 15:01:17 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.200.242.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.50
country_id: 953987
description:
Jan 28 15:01:15 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.162
country_id: 3469034
description:
Jan 28 15:01:38 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:01:49 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:03:54 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 15:03:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:64819: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.232.164
country_id: 3437598
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/solution.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.232.73
country_id: 6252001
description:
2026-01-28 15:03:29 dovecot_login authenticator failed for H=(ADMIN) [102.129.232.73]:61818: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-28 15:04:34 +0800] info [webmaild] 203.106.96.63 - muslihin@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 15:04:36 H=([10.1.1.180]) [60.54.167.90]:49799 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.49.239.79
country_id: 1733045
description:
[2026-01-28 15:04:57 +0800] info [webmaild] 60.49.239.79 - khairul_aa@ajplantations.com.my "POST /cpsess3431636694/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [115.133.15.198] != Current IP Address [60.49.239.79]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 28 15:06:02 sv3 pure-ftpd[4042609]: (?@113.211.212.49) [INFO] New connection from 113.211.212.49


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 15:06:01 H=([10.1.1.140]) [60.54.167.90]:49173 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 15:06:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56752: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:06:14 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.181
country_id: 3175395
description:
Jan 28 15:07:10 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:07:21 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.178
country_id: 6252001
description:
Jan 28 15:08:36 sv3 pure-ftpd[4047717]: (?@91.230.168.178) [INFO] New connection from 91.230.168.178


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.180
country_id: 6252001
description:
Jan 28 15:08:36 sv3 pure-ftpd[4047723]: (?@91.230.168.180) [INFO] New connection from 91.230.168.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:09:26 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 15:10:49 H=([10.1.1.140]) [60.54.167.90]:49274 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.115
country_id: 2635167
description:
Jan 28 15:11:37 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:11:46 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:13:00 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-28 15:14:40 H=([10.1.1.140]) [60.54.167.90]:49308 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:15:08 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.52
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 89.251.0.52
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Block interaction with malicious plugin||RSV:7.67||T:APACHE||SC:/home2/maalloyscom/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.52
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home2/maalloyscom/public_html/wp-admin||


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.52
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.47
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/admin.php||SC:/home2/maalloyscom/public_html/images/admin.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.52
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/admin/upload/css.php||SC:/home2/maalloyscom/public_html/admin||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 89.251.0.47
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:7.67||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:17:28 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:18:35 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.115
country_id: 2635167
description:
Jan 28 15:18:40 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 15:19:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:11535: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.47
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/uploads/file.php||SC:/home2/maalloyscom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.204.15.193
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78961514527453 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.106.49.162
country_id: 1527747
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/swing/10/727/1015467 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.90
country_id: 2635167
description:
2026-01-28 15:20:47 dovecot_login authenticator failed for H=(ADMIN) [98.159.234.90]:27149: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:20:40 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.181.123.12
country_id: 3469034
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/services.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.64.27
country_id: 1733045
description:
[2026-01-28 15:21:16 +0800] info [webmaild] 113.211.64.27 - azlin@indfinitydesign.com "GET /cpsess2622954474/webmail/jupiter/index.html?login=1&post_login=95425802296661 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.97.157.127
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/often/11/22/1158245 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 15:21:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:17738: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.52
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/wp-aespa.php||SC:/home2/maalloyscom/public_html/images/wp-aespa.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:23:00 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.251.0.52
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/maalloyscom/public_html/wp-includes||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.32.4
country_id: 1269750
description:
Jan 28 15:23:01 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.32.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.52
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/1.php||WPU:||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.52
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/uploads/af32.php||SC:/home2/maalloyscom/public_html/uploads||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 89.251.0.52
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Block interaction with malicious plugin||RSV:7.67||T:APACHE||SC:/home2/maalloyscom/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/install.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:24:07 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.47
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/include.php||WPU:||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.219
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/fonts/flaticon/flaticon.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.243
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/css/owl.carousel.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.206
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/js/bootstrap.bundle.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.226
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/js/owl.carousel.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.236
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/css/style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.228
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/css/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/js/form-validator.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.129
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/fonts/boxicons.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.252
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/js/jquery.magnific-popup.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 89.251.0.47
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home2/maalloyscom/public_html/wp-includes||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.167
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/js/jquery.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 89.251.0.47
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/themes.php||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.215
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/css/boxicons.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.220
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/css/dark.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.251.0.47
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/uploads/xsec.php||SC:/home2/maalloyscom/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.190
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/css/owl.theme.default.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.207
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/js/contact-form-script.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.230
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/js/jquery.nice-select.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.215.167.154
country_id: 1168579
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.239
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/css/meanmenu.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.170
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/css/nice-select.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.197
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/css/magnific-popup.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 89.251.0.47
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:7.67||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.157
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/css/responsive.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.233
country_id: 1880251
domain: kainanholding.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kainanholding.com/assets/js/custom.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:26:12 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 89.251.0.47
country_id: 6251999
domain: maalloys.com.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/dedi1.php||WPU:||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:28:32 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.127
country_id: 2300660
description:
Jan 28 15:28:12 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:29:39 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.246.198
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-30.144.124.246.198||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:31:43 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 15:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:65045: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:34:03 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-28 15:34:05 H=([45.144.212.242]) [45.144.212.242]:51747 F=<info@starorganizasyon.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 45.144.212.242 is not allowed to send mail from starorganizasyon.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 15:34:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56918: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:35:11 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.137.35
country_id: 690791
description:
Jan 28 15:36:10 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.137.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.233.231.204
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-37.140.233.231.204||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:37:16 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-28 15:38:30 H=([45.144.212.242]) [45.144.212.242]:53193 F=<info@starorganizasyon.com> rejected RCPT <info@mkmetal.com.my>: SPF: 45.144.212.242 is not allowed to send mail from starorganizasyon.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.94.190.204
country_id: 719819
description:
2026-01-28 15:38:44 dovecot_login authenticator failed for H=(ADMIN) [185.94.190.204]:50340: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:39:35 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:40:43 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 199.45.154.117
country_id: 6252001
description:
2026-01-28 15:40:17 873975 [Warning] Aborted connection 873975 to db: 'unconnected' user: 'unauthenticated' host: '199.45.154.117' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:42:47 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.105.154
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/teletech-at-home-employee-reviews HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.105.154
country_id: 3469034
domain: tujusetia.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.myhttp/tujusetia.my/teletech-at-home-employee-reviews HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:45:07 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:46:15 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 15:47:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:11543: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.9
country_id: 1269750
description:
Jan 28 15:47:23 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:48:19 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.115
country_id: 2635167
description:
Jan 28 15:48:58 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-28 15:49:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:17744: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:50:39 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:51:47 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.78.242
country_id: 1562822
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/2016/04/04/admission-application-and-academic-essays-7/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.78.242
country_id: 1562822
domain: tujusetia.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.myhttp/tujusetia.my/2016/04/04/admission-application-and-academic-essays-7/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:53:51 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.207.143
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/mockery/exceptions.rst HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.126.210
country_id: 6252001
description:
Jan 28 15:55:20 sv3 pure-ftpd[4120724]: (?@135.237.126.210) [INFO] New connection from 135.237.126.210


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:56:11 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:57:19 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.192
country_id: 6252001
description:
2026-01-28 15:58:26 874670 [Warning] Aborted connection 874670 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.192' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-28 15:59:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:65133: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 15:59:24 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-28 16:01:06 H=([45.144.212.54]) [45.144.212.54]:50051 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<events@latinserverhost.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 16:01:43 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-28 16:02:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57048: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 28 16:02:51 sv3 auth[3890712]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-28 16:02:56 H=([45.144.212.50]) [45.144.212.50]:58287 F=<waikeong.poon@seatrium.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from seatrium.com


