# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.47.83.21
country_id: 732800
description:
Jan 24 13:21:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.47.83.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 13:22:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pdns/pdns.conf||User:named||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 13:24:13 sv3 pure-ftpd[2961890]: (?@175.143.194.178) [WARNING] Authentication failed for user [oxboldc]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.47.2
country_id: 1269750
description:
Jan 24 13:24:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.47.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 13:24:27 sv3 pure-ftpd[2962137]: (?@175.143.194.178) [WARNING] Authentication failed for user [oxboldc]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2026-01-24 13:24:26 dovecot_login authenticator failed for H=([27.123.105.140]) [182.95.47.2]:41888: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pulse/client.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.146.195
country_id: 690791
description:
Jan 24 13:24:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.146.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 13:24:08 sv3 pure-ftpd[2961890]: (?@175.143.194.178) [INFO] New connection from 175.143.194.178


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/request-key.d/id_resolver.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-01-24 13:27:57 dovecot_login authenticator failed for H=(nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:37280: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.55.240
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=342496 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/samba/smb.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.248.231
country_id: 3469034
description:
Jan 24 13:27:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.248.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.72.102.106
country_id: 1269750
description:
Jan 24 13:27:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.72.102.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.248.231
country_id: 3469034
description:
Jan 24 13:28:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.248.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 13:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62485: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.5.108.11
country_id: 2186224
description:
Jan 24 13:28:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.5.108.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.95
country_id: 3996063
description:
Jan 24 13:28:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/access.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/sepermit.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.161.85
country_id: 3469034
description:
Jan 24 13:29:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.161.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.75
country_id: 3469034
description:
Jan 24 13:30:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sw-engine/sw-engine-fpm.conf||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.44.102.47
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-32.152.44.102.47||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sysconfig/nftables.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sysctl.d/90-webshield-ip-local-reserved.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.72.178
country_id: 798544
description:
Jan 24 13:34:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.72.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/udev/udev.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.185
country_id: 953987
description:
Jan 24 13:34:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.206
country_id: 690791
description:
Jan 24 13:34:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.156
country_id: 3469034
description:
Jan 24 13:34:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.253.103
country_id: 3865483
description:
Jan 24 13:35:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.253.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.214
country_id: 6290252
description:
Jan 24 13:35:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.214
country_id: 6290252
description:
Jan 24 13:36:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.96
country_id: 99237
description:
Jan 24 13:37:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.189.66.5
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=953052 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/environment.d/99-environment.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.73.217.130
country_id: 3469034
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/blog/03.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 13:40:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.213.140
country_id: 1562822
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/product.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.125.223.48
country_id: 3469034
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/blog/01.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/kernel/install.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 13:45:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.185.80
country_id: 3469034
description:
Jan 24 13:46:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.185.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.0.189.231
country_id: 3469034
description:
Jan 24 13:46:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.0.189.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.0.189.231
country_id: 3469034
description:
Jan 24 13:47:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.0.189.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/modprobe.d/dist-alsa.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 13:48:02 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:34294: 535 Incorrect authentication data (set_id=news@maalloys.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: aire-fresh.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/111.0.5563.19 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.168.86.32
country_id: 617790
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=486189 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 13:50:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 13:51:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.134
country_id: 798544
description:
Jan 24 13:51:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.134
country_id: 798544
description:
Jan 24 13:52:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.73.7
country_id: 798544
description:
Jan 24 13:52:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.73.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 13:54:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysctl.d/10-default-yama-scope.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/systemd/resolv.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 13:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62520: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/basic.conf||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.160
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-00.92.71.72.160||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/apache2.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/rpcbind.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 14:01:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.9
country_id: 2395170
description:
Jan 24 14:02:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 14:04:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.19.8
country_id: 3469034
description:
Jan 24 14:05:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.19.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.188.233
country_id: 99237
description:
Jan 24 14:05:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.188.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 14:05:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.168.34.113
country_id: 6252001
description:
Jan 24 14:06:16 sv3 pure-ftpd[2990116]: (?@206.168.34.113) [INFO] New connection from 206.168.34.113


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.25.53
country_id: 2589581
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/3-1-300x205.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.198.240
country_id: 2510769
description:
Jan 24 14:07:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.198.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:07:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.137
country_id: 690791
description:
Jan 24 14:07:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.122.186
country_id: 1733045
description:
2026-01-24 14:08:09 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [113.211.122.186]:10003: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:08:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/opt/ai-bolit/AIBOLIT-BINMALWARE.db||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:10:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 14:10:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/opt/ai-bolit/mds-ai-bolit-hoster.cache.db||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.127
country_id: 3175395
description:
Jan 24 14:11:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:12:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.172.248.219
country_id: 3351879
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Session/SessionInterface.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:14:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.152
country_id: 3175395
description:
Jan 24 14:15:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:16:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 14:16:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.49.249.47
country_id: 3175395
description:
Jan 24 14:16:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.49.249.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jan 24 14:17:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-24 14:17:58 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:33922: 535 Incorrect authentication data (set_id=postmaster@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.40.225.36
country_id: 286963
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/embededPhp.yml HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:18:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:19:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.241.84.185
country_id: 99237
domain: mail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.fimco.com.my/cgi-bin HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.134.162.255
country_id: 1227603
domain: mail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.fimco.com.my/cgi-bin/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 14:21:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:21:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.245.156
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/contact.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:24:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 14:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62559: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.194.58.109
country_id: 290291
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/author/master HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:25:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.122.186
country_id: 1733045
description:
2026-01-24 14:25:17 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [113.211.122.186]:10014: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/103.0.5058.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.122.186
country_id: 1733045
description:
2026-01-24 14:26:44 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [113.211.122.186]:10018: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.80
country_id: 3469034
description:
Jan 24 14:27:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 14:27:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:27:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.224.163
country_id: 337996
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/Loader/MoFileLoaderTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.236.187.43
country_id: 2017370
description:
Jan 24 14:29:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.236.187.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.187.43
country_id: 2017370
description:
2026-01-24 14:29:09 dovecot_plain authenticator failed for H=(opped) [85.236.187.43]:60580: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 14:29:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:29:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.18.144
country_id: 1269750
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/contact.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.156.147.168
country_id: 2623032
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/images/u2695-29.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 14:30:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 24 14:30:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 14:31:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.84.179.128
country_id: 3996063
description:
Jan 24 14:31:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.84.179.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-24 14:31:15 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:55762: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.159.105.232
country_id: 1733045
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/about.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/opt/scripts/lock.sh.old||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/opt/scripts/mxcheck.sh.old||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 14:33:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/opt/scripts/sync-nfs.sh.old||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 14:36:50 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:52255: 535 Incorrect authentication data (set_id=postmaster@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.39
country_id: 3469034
description:
Jan 24 14:37:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.134
country_id: 798544
description:
Jan 24 14:37:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib64/icu/Makefile.inc||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.39
country_id: 3469034
description:
Jan 24 14:38:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.26.115.113
country_id: 2464461
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=81621516694494 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.64.82
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-more.php?id=274446 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.70.87.52
country_id: 2363686
description:
Jan 24 14:43:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.70.87.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.137
country_id: 690791
description:
Jan 24 14:44:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.70.87.52
country_id: 2363686
description:
Jan 24 14:44:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.70.87.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.132.244
country_id: 3175395
description:
Jan 24 14:47:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.132.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.130.33
country_id: 99237
description:
Jan 24 14:48:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.130.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.130.33
country_id: 99237
description:
Jan 24 14:49:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.130.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.242.78.9
country_id: 3469034
description:
Jan 24 14:49:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.242.78.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.171.159.156
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-51.31.171.159.156||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 14:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62593: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.31
country_id: 3469034
description:
Jan 24 14:53:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.138.83
country_id: 3469034
description:
Jan 24 14:53:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.138.83 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.188.76
country_id: 6252001
description:
2026-01-24 14:55:24 dovecot_login authenticator failed for H=([127.0.0.1]) [172.59.188.76]:8048: 535 Incorrect authentication data (set_id=info@u-net.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.137
country_id: 732800
description:
Jan 24 14:56:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.66.138
country_id: 1269750
description:
Jan 24 14:56:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.66.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.66.138
country_id: 1269750
description:
Jan 24 14:56:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.66.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-01-24 14:58:30 H=([77.83.39.56]) [77.83.39.56]:58530 F=<advising.service@advising.hsbc.com> rejected RCPT <astkbr@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.207
country_id: 298795
description:
Jan 24 14:58:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-24 14:58:52 H=(localhost.localdomain) [78.153.140.207]:50746 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.136.107.106
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/RichText.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.224
country_id: 953987
description:
Jan 24 14:58:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.207
country_id: 298795
description:
Jan 24 14:58:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-24 15:00:06 H=([45.144.212.50]) [45.144.212.50]:60274 F=<advising.service@advising.hsbc.com> rejected RCPT <astmyy@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.32.70
country_id: 3469034
description:
Jan 24 15:01:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.239.52.100
country_id: 1831722
description:
2026-01-24 15:01:26 dovecot_plain authenticator failed for H=(wigpnjdosa0ajal5dz5s5p28lwr6b) [103.239.52.100]:47765: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.244.2.98
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activities.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-24 15:03:21 H=(localhost.localdomain) [78.153.140.207]:45570 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 15:04:27 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:43380: 535 Incorrect authentication data (set_id=it@tujusetia.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 15:04:38 H=([45.144.212.242]) [45.144.212.242]:65084 F=<lynnied@mhtc.net> rejected RCPT <zainuddin@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.56.49.38
country_id: 1835841
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/our-services/icon-our-services-manufacturing_blue.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.38.244.193
country_id: 3469034
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/index.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.150.219
country_id: 99237
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/main/isotope.pkgd.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.173.22.143
country_id: 3469034
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/icon/et-line-font.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.197.211
country_id: 3923057
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/main/owl.carousel.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.239
country_id: 798544
description:
Jan 24 15:07:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.248
country_id: 732800
description:
Jan 24 15:07:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.248 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.193.145.52
country_id: 1643084
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/owl-carousel/owl.theme.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.254.100.1
country_id: 3996063
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/progress-bar/bootstrap-progressbar-main.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.34.131
country_id: 192950
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/textillate/jquery.textillate.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.140.129.118
country_id: 3996063
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/main/parallax.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.113.49.100
country_id: 3469034
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/textillate/jquery.fittext.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.135.135.162
country_id: 1210997
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/magnific-popup/magnific-popup-zoom-gallery.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.244.156.192
country_id: 1522867
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/textillate/jquery.lettering.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.186.238.22
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/nesbot/carbon/src/Carbon/Upgrade.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.172.247.48
country_id: 294640
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/owl-carousel/owl.transitions.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.149.42.138
country_id: 3595528
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/core/bootstrap.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.251.213.173
country_id: 1527747
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/core/jquery.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.242.163.35
country_id: 953987
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/main/jquery.appear.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.152.5.37
country_id: 3469034
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/core/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.155.20.237
country_id: 1282988
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/core/animate.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.241.24.222
country_id: 1527747
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/progress-bar/bootstrap-progressbar.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.165.118.164
country_id: 953987
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/icon/font-awesome.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.223.74
country_id: 953987
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/magnific/magnific-popup.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.4.99.126
country_id: 1269750
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/main/main.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.58.96.26
country_id: 3439705
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/main/imagesloaded.pkgd.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.196.193.232
country_id: 1269750
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/magnific/magic.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.166.247.193
country_id: 3508796
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/main/ion.rangeSlider.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.207.205.236
country_id: 290557
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/main/jquery.countTo.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.87.226
country_id: 99237
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/js/main/jquery.sticky.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.57.168.26
country_id: 3658394
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/main/setting.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.30.100
country_id: 3865483
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/main/hover.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.5.205.194
country_id: 3469034
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/magnific/magnific-popup-zoom-gallery.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.167.26.236
country_id: 933860
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/owl-carousel/owl.carousel.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.22.184
country_id: 1562822
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/products.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.97.28.96
country_id: 2589581
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/color/pasific.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.61.252.146
country_id: 3865483
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/css/main/main.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.135.254.37
country_id: 1210997
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/assets/fonts/font-awesome/fontawesome-webfont.woff2?v=4.5.0 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 15:08:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.25.235.59
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=235857 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.142.25
country_id: 3469034
description:
Jan 24 15:08:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.142.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.143.17.18
country_id: 6252001
description:
Jan 24 15:09:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.143.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.143.17.18
country_id: 6252001
description:
2026-01-24 15:09:34 dovecot_login authenticator failed for H=47-143-17-18.fdr02.elsn.ca.frontiernet.net [47.143.17.18]:20301: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.142.25
country_id: 3469034
description:
Jan 24 15:09:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.142.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.54
country_id: 3175395
description:
Jan 24 15:11:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.252.52
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/advertise.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.221
country_id: 3469034
description:
Jan 24 15:13:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.221 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.70.44
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-14.142.111.70.44||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.6.208.175
country_id: 1269750
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/the-face-suite-hotel.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.221
country_id: 3469034
description:
Jan 24 15:14:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.12.250
country_id: 3469034
description:
Jan 24 15:14:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.12.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.187.167.72
country_id: 1269750
description:
Jan 24 15:16:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.187.167.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 15:20:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62627: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.76.122
country_id: 3469034
description:
Jan 24 15:22:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.76.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.136.20
country_id: 99237
description:
Jan 24 15:22:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.136.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.146.212
country_id: 3469034
description:
Jan 24 15:22:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.146.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.30.230
country_id: 226074
description:
Jan 24 15:22:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.30.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.228
country_id: 3469034
description:
Jan 24 15:23:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.228 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.5.64
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=91911516784325 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.30.230
country_id: 226074
description:
Jan 24 15:23:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.30.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.40
country_id: 3865483
description:
Jan 24 15:25:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.40
country_id: 3865483
description:
Jan 24 15:26:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.236
country_id: 3469034
description:
Jan 24 15:26:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.236 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/run/NetworkManager/no-stub-resolv.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.253.250.249
country_id: 2960313
description:
[2026-01-24 15:29:28 +0800] info [webmaild] 192.253.250.249 - chew@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.40.85
country_id: 3469034
description:
Jan 24 15:30:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.40.85
country_id: 3469034
description:
Jan 24 15:31:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.190
country_id: 953987
description:
Jan 24 15:33:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.190 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.47.97
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30071531896797 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 15:35:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.66.21
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=453297 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/run/blkid/blkid.tab.old||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.140
country_id: 1269750
description:
Jan 24 15:40:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 15:40:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 15:41:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.97.9
country_id: 3469034
description:
Jan 24 15:41:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.97.9 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.27
country_id: 6252001
description:
2026-01-24 15:42:14 647207 [Warning] Aborted connection 647207 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.27' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.76.128.168
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=40461515570781 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.123.58
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=18391515043506 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 15:44:36 sv3 pure-ftpd[3056427]: (?@175.143.194.178) [INFO] New connection from 175.143.194.178


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 15:44:42 sv3 pure-ftpd[3056427]: (?@175.143.194.178) [WARNING] Authentication failed for user [oxboldc]


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 15:45:24 sv3 pure-ftpd[3057156]: (oxboldc@175.143.194.178) [NOTICE] /home/oxboldc//public_html/paramotor-malaysia.htm uploaded  (58296 bytes, 3468.98KB/sec)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 15:45:21 sv3 pure-ftpd[3057156]: (?@175.143.194.178) [INFO] New connection from 175.143.194.178


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 15:46:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.71.81
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=982714 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.206.128
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=40 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 15:48:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62656: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.94.39.18
country_id: 6252001
description:
[2026-01-24 15:49:53 +0800] info [cpaneld] 23.94.39.18 - oxboldc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.55
country_id: 3996063
description:
Jan 24 15:50:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 15:51:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.249.211.7
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=51451516781780 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.133
country_id: 3175395
description:
Jan 24 15:53:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.85
country_id: 3469034
description:
Jan 24 15:54:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.82
country_id: 3865483
description:
Jan 24 15:57:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.82
country_id: 3865483
description:
Jan 24 15:58:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.137
country_id: 1269750
description:
Jan 24 15:58:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.124
country_id: 798544
description:
Jan 24 15:58:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.206
country_id: 3175395
description:
Jan 24 15:59:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 15:59:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.29.235.217
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-59.154.29.235.217||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.226
country_id: 2510769
description:
Jan 24 15:59:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.133.72
country_id: 3175395
description:
Jan 24 15:59:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.133.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.210.70.57
country_id: 6252001
domain: www.oxbold.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/68.0.3440.106 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 123.136.114.10
country_id: 1733045
domain: fasterget.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:123.136.114.10||TA:123.136.114.10||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.206
country_id: 3175395
description:
Jan 24 16:00:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.253.6
country_id: 3865483
description:
Jan 24 16:00:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.253.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 16:00:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.232
country_id: 298795
description:
Jan 24 16:00:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.232 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 175.41.216.210
country_id: 1861060
domain: agsaintifik.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:175.41.216.210||TA:175.41.216.210||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.44.98.177
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-02.152.44.98.177||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 16:04:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.85
country_id: 798544
description:
Jan 24 16:04:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.85
country_id: 798544
description:
Jan 24 16:05:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.40
country_id: 1269750
description:
Jan 24 16:05:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 216.126.239.87
country_id: 6252001
domain: maalloys.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/567.36 (KHTML, like Gecko) HeadlessChrome/132.5.6834.110 Safari/537.06 WP.com mShots||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 24 16:06:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.52.43
country_id: 1562822
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/social_english_course.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/plug/sms/img/news.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.92.203.127
country_id: 2782113
description:
Jan 24 16:10:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.92.203.127 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.105.189
country_id: 1562822
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/toefl_preparation.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.121
country_id: 3469034
description:
Jan 24 16:10:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.239.127.99
country_id: 1562822
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/ielts_preparation.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/demos/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 16:12:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.98.32
country_id: 1562822
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/primary_school_english.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 16:13:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.12
country_id: 2750405
description:
Jan 24 16:13:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-14.77.238.251.212||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.214.117.91
country_id: 953987
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/cambridge_english.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.221.180
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=714389 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 16:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62697: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.110
country_id: 3175395
description:
Jan 24 16:17:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.99.154
country_id: 3865483
description:
Jan 24 16:17:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.99.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.25.251.213
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/FatalErrorHandler/UndefinedMethodFatalErrorHandler.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
country_id: 2510769
description:
Jan 24 16:18:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-24 16:18:43 dovecot_login authenticator failed for H=(228.pool90-161-217.static.orange.es) [90.161.217.228]:34004: 535 Incorrect authentication data (set_id=secretaria@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.116
country_id: 3469034
description:
Jan 24 16:19:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.116
country_id: 3469034
description:
Jan 24 16:20:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.207
country_id: 3469034
description:
Jan 24 16:20:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.207 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.181.176.44
country_id: 2029969
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/global-state/tests/BlacklistTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.31.226
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=192351 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 16:21:31 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:60675: 535 Incorrect authentication data (set_id=secretaria@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.50
country_id: 3175395
description:
Jan 24 16:25:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.210
country_id: 3175395
description:
Jan 24 16:25:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 16:25:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/apm/images/monthly-report.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.210
country_id: 3175395
description:
Jan 24 16:25:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.229
country_id: 1269750
description:
Jan 24 16:27:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.50
country_id: 3469034
description:
Jan 24 16:27:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.153.48.43
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=936837 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/run/dovecot/dovecot.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.92.53.226
country_id: 453733
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/about/about-chs-steelworks3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.212.56
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=31481514882479 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.141.127
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/teamwork.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.250.114.39
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/exhibition.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.144.145
country_id: 690791
description:
Jan 24 16:33:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.144.145 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.5.118
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=29501515117407 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.245.125.60
country_id: 1527747
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/33chartcreate-line.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.123.6
country_id: 1733045
description:
[2026-01-24 16:35:58 +0800] info [webmaild] 113.211.123.6 - s-osada@mckd.com.my "GET /cpsess5398263805/?=undefined&login=1&post_login=14519782943608 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [202.188.218.208] != Current IP Address [113.211.123.6]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 16:36:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.62.20.12
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/swiftmailer/swiftmailer/doc/index.rst HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.61.56.7
country_id: 3439705
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/markbaker/matrix/classes/src/Exception.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.144.61.16
country_id: 2542007
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/author/charlespicoohm-com HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.195.117
country_id: 1562822
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/vibration-roller.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.41.186
country_id: 3658394
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/corporate-structure.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.255.58.146
country_id: 1168579
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/accessories.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.192.150
country_id: 1562822
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/projects.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.99
country_id: 3469034
description:
Jan 24 16:39:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.225
country_id: 3865483
description:
Jan 24 16:39:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.222
country_id: 3077311
description:
Jan 24 16:39:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.225
country_id: 3865483
description:
Jan 24 16:40:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 16:40:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.19.206
country_id: 1269750
description:
Jan 24 16:41:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.19.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.118
country_id: 3469034
description:
Jan 24 16:42:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.75.102
country_id: 953987
domain: ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.19.206
country_id: 1269750
description:
Jan 24 16:42:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.19.206 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 178.20.47.39
country_id: 2017370
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:16-42.178.20.47.39||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 54.223.45.134
country_id: 1814991
domain: indfinitydesign.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 16:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62727: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.122.186
country_id: 1733045
description:
2026-01-24 16:46:25 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [113.211.122.186]:10045: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.38.152.68
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34041515726154 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 16:47:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.9
country_id: 953987
description:
Jan 24 16:48:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.239
country_id: 1269750
description:
Jan 24 16:49:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 16:49:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.110.181.6
country_id: 3865483
description:
Jan 24 16:50:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.110.181.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.242
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/nl/index.db||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.102
country_id: 226074
description:
Jan 24 16:51:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.102 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.8
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/fr/index.db||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.211.148.221
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=159341 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.223.86
country_id: 798544
description:
Jan 24 16:56:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.223.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.223.86
country_id: 798544
description:
Jan 24 16:56:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.223.86 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-58.77.238.251.212||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.19.168
country_id: 4566966
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=508596 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 17:00:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 17:01:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 17:01:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.42.196.70
country_id: 2635167
domain: mams.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/mams.manforce.net/uploads/arrangement/MANFORCE_TRANSFER_LIST_(16_5_2024)-32.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 17:04:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.191.221.69
country_id: 337996
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/116849.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.47.50.142
country_id: 1168579
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&sub=23 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.115
country_id: 6252001
description:
2026-01-24 17:07:24 650525 [Warning] Aborted connection 650525 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.115' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.5
country_id: 3469034
description:
Jan 24 17:09:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.224
country_id: 3469034
description:
Jan 24 17:11:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.29.118
country_id: 226074
description:
Jan 24 17:11:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.29.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 17:12:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55633: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.29.118
country_id: 226074
description:
Jan 24 17:12:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.29.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 167.56.182.55
country_id: 3439705
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/50-user.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.2
country_id: 226074
description:
Jan 24 17:14:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.157.212.152
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-14.185.157.212.152||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.5
country_id: 798544
description:
Jan 24 17:15:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.121
country_id: 3469034
description:
Jan 24 17:15:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.245.13.243
country_id: 1269750
description:
Jan 24 17:15:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.245.13.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.130.207.89
country_id: 2623032
description:
Jan 24 17:15:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.130.207.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.177.133
country_id: 6252001
description:
Jan 24 17:17:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.173.177.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-24 17:17:24 dovecot_login authenticator failed for H=(refkus) [107.173.177.133]:65466: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-01-24 17:18:16 +0800] info [cpaneld] 103.210.132.14 - ajplanta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplanta (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 17:19:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 24 17:19:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.150.75
country_id: 690791
description:
Jan 24 17:19:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.150.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-24 17:19:50 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:60282: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.211
country_id: 3469034
description:
Jan 24 17:19:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.214
country_id: 3865483
description:
Jan 24 17:19:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.150.75
country_id: 690791
description:
Jan 24 17:20:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.150.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.99
country_id: 690791
description:
2026-01-24 17:20:55 H=([77.83.39.99]) [77.83.39.99]:63762 F=<luciano@rooftech.com.br> rejected RCPT <sales@webhosting2u.com>: SPF: 77.83.39.99 is not allowed to send mail from rooftech.com.br


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.121.95.197
country_id: 3469034
description:
Jan 24 17:21:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.121.95.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 54.148.144.216
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/blog/mon/particulier/loginform3ad6.php||SC:/home2/cabecom/public_html/img/blog||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.153
country_id: 3175395
description:
Jan 24 17:22:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.144.241
country_id: 1733045
description:
2026-01-24 17:23:44 dovecot_login authenticator failed for H=([113.211.144.241]) [113.211.144.241]:41223: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 17:24:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.75.141.201
country_id: 1733045
domain: mckd.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:202.75.141.201||TA:202.75.141.201||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.107
country_id: 3865483
description:
Jan 24 17:25:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.199
country_id: 3469034
description:
Jan 24 17:26:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.43.30.3
country_id: 1835841
description:
Jan 24 17:28:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.43.30.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.43.30.3
country_id: 1835841
description:
2026-01-24 17:28:11 dovecot_login authenticator failed for H=([118.43.30.3]) [118.43.30.3]:41212: 535 Incorrect authentication data (set_id=newsletter@kimmark.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-24 17:28:32 H=([77.83.39.187]) [77.83.39.187]:55994 F=<dina@backcombined.com> rejected RCPT <admin@fkr.com.my>: SPF: 77.83.39.187 is not allowed to send mail from backcombined.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.157
country_id: 3469034
description:
Jan 24 17:30:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 17:30:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.12.133.18
country_id: 3865483
description:
Jan 24 17:31:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.12.133.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.209.138
country_id: 798544
description:
Jan 24 17:33:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.209.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.50.110
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=900301 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.249
country_id: 953987
description:
Jan 24 17:34:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.134.100
country_id: 3469034
description:
Jan 24 17:35:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.134.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.186.18.251
country_id: 798544
description:
Jan 24 17:35:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.186.18.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.167
country_id: 1269750
description:
Jan 24 17:35:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.167 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.186.18.251
country_id: 798544
description:
Jan 24 17:36:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.186.18.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 17:39:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 17:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55660: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 17:40:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 17:41:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 17:42:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.14.61.157
country_id: 298795
description:
Jan 24 17:43:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.14.61.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.138.12
country_id: 690791
description:
Jan 24 17:43:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.138.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 17:43:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 17:44:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.21
country_id: 2750405
description:
Jan 24 17:44:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.22
country_id: 2750405
description:
Jan 24 17:44:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.224
country_id: 3469034
description:
Jan 24 17:46:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 17:47:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.226.120
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/productt.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 27.42.64.0
country_id: 1814991
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-48.27.42.64.0||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.134.230
country_id: 6252001
description:
2026-01-24 17:48:31 652319 [Warning] Aborted connection 652319 to db: 'unconnected' user: 'unauthenticated' host: '71.6.134.230' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.109.168.244
country_id: 3469034
description:
Jan 24 17:48:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.109.168.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.79.232
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-49.92.71.79.232||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.13
country_id: 2750405
description:
Jan 24 17:49:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 17:49:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 17:50:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.121.166
country_id: 3469034
description:
Jan 24 17:51:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.121.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.31.92.10
country_id: 798544
description:
Jan 24 17:51:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.31.92.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.121.166
country_id: 3469034
description:
Jan 24 17:52:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.121.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.207.143
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14321514882889 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.46
country_id: 3175395
description:
Jan 24 17:52:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.158
country_id: 3469034
description:
Jan 24 17:52:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.3.93
country_id: 953987
description:
Jan 24 17:52:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.3.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.248
country_id: 1269750
description:
Jan 24 17:53:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.158
country_id: 3469034
description:
Jan 24 17:53:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/es/images/index.php||SC:/home/indfinitydesign/public_html/es||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.109.166
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=45021514883483 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 17:59:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.188.97
country_id: 3469034
description:
Jan 24 18:01:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.188.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.130.76
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=569531 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.121.189
country_id: 337996
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/3249053632.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.53
country_id: 933860
description:
Jan 24 18:03:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 18:03:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.229
country_id: 3865483
description:
Jan 24 18:03:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.209
country_id: 3175395
description:
Jan 24 18:03:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.0.46
country_id: 953987
description:
Jan 24 18:03:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.0.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.229
country_id: 3865483
description:
Jan 24 18:04:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.104.246
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=86491516693580 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.157.212.152
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-06.185.157.212.152||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.123
country_id: 953987
description:
Jan 24 18:07:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.46
country_id: 953987
description:
Jan 24 18:08:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 18:08:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.49
country_id: 298795
description:
Jan 24 18:08:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.123
country_id: 953987
description:
Jan 24 18:08:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 18:08:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55707: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.77.241
country_id: 1269750
description:
Jan 24 18:10:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.77.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.77.241
country_id: 1269750
description:
2026-01-24 18:10:42 dovecot_login authenticator failed for H=(sahajav12dev-test) [139.59.77.241]:40700: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.77.241
country_id: 1269750
description:
2026-01-24 18:10:59 dovecot_login authenticator failed for H=(sahajav12dev-test) [139.59.77.241]:57116: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.235
country_id: 6252001
description:
Jan 24 18:11:37 sv3 pure-ftpd[3152984]: (?@198.235.24.235) [INFO] New connection from 198.235.24.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
country_id: 690791
description:
Jan 24 18:12:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-01-24 18:12:34 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:56605: 535 Incorrect authentication data (set_id=hello@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.122.173
country_id: 3469034
description:
Jan 24 18:15:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.122.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.82
country_id: 3865483
description:
Jan 24 18:15:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:15:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 18:18:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.123.178
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=513447 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 20.230.136.38
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.161.71
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=731605 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.136
country_id: 2510769
description:
Jan 24 18:25:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:25:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.233.15.25
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-25.104.233.15.25||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.251
country_id: 3469034
description:
Jan 24 18:26:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.136
country_id: 2510769
description:
Jan 24 18:26:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:28:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.66.178.169
country_id: 2017370
description:
Jan 24 18:31:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.66.178.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.152
country_id: 3077311
description:
Jan 24 18:31:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.22
country_id: 2750405
description:
Jan 24 18:31:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.152
country_id: 3077311
description:
2026-01-24 18:31:48 dovecot_plain authenticator failed for H=([10.22.18.175]) [212.102.39.152]:42609: 535 Incorrect authentication data (set_id=rayerlink@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.57.90
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=43301526631723 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.178.169
country_id: 2017370
description:
2026-01-24 18:31:19 dovecot_plain authenticator failed for H=(mernes) [95.66.178.169]:50060: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.21
country_id: 2750405
description:
Jan 24 18:31:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 18:31:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.152
country_id: 3077311
description:
Jan 24 18:32:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 18:32:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.121.51.247
country_id: 1668284
description:
2026-01-24 18:32:55 H=([45.121.51.247]) [45.121.51.247]:51582 F=<huntington-alerts@huntington.net> rejected RCPT <sales@webhosting2u.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.152
country_id: 3077311
description:
2026-01-24 18:32:01 dovecot_plain authenticator failed for H=([10.22.18.175]) [212.102.39.152]:56200: 535 Incorrect authentication data (set_id=entral@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:33:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.213.245.175
country_id: 1269750
description:
Jan 24 18:34:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.213.245.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.114.140.70
country_id: 3469034
description:
Jan 24 18:35:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.114.140.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 18:36:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55731: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.215.88
country_id: 3469034
description:
Jan 24 18:37:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.215.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.215.88
country_id: 3469034
description:
Jan 24 18:38:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.215.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 18:38:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.57
country_id: 690791
description:
Jan 24 18:38:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.171.117
country_id: 3469034
description:
Jan 24 18:40:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.171.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.19
country_id: 953987
description:
Jan 24 18:40:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 18:40:10 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:37382: 535 Incorrect authentication data (set_id=support@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.19
country_id: 953987
description:
Jan 24 18:41:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:41:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 176.123.1.159
country_id: 617790
domain: manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/126.0.7.0 Safari/537.35||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.254
country_id: 1269750
description:
Jan 24 18:42:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.254 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/press.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/about-us/faq/images/about.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.39
country_id: 719819
description:
Jan 24 18:46:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 18:46:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.78
country_id: 2300660
description:
Jan 24 18:46:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:46:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.39
country_id: 719819
description:
Jan 24 18:47:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.222.93
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=76 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:49:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 18:52:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 124.13.192.28
country_id: 1733045
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=758571 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.244.67.30
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Profiler/FileProfilerStorage.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.94.247
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=947582 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.180.105.15
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-58.216.180.105.15||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 18:59:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.176
country_id: 798544
description:
Jan 24 19:01:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.182.22.173
country_id: 690791
description:
Jan 24 19:01:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.182.22.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.155.135.23
country_id: 3469034
description:
Jan 24 19:01:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.155.135.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.155.135.23
country_id: 3469034
description:
Jan 24 19:02:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.155.135.23 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 19:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55775: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.68
country_id: 798544
description:
Jan 24 19:05:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.199.10
country_id: 3658394
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Recorder.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.93
country_id: 953987
description:
Jan 24 19:06:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-24 19:07:27 +0800] info [cpaneld] 202.178.120.157 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 19:09:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.227.39
country_id: 3437598
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/src/ManifestDocumentMapper.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 19:11:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.213
country_id: 3175395
description:
Jan 24 19:11:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.50
country_id: 3469034
description:
Jan 24 19:11:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.50
country_id: 3469034
description:
Jan 24 19:12:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 19:12:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:14:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.165.103.166
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1310 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-24 19:16:08 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:65165: 535 Incorrect authentication data (set_id=updated)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 24 19:16:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.137
country_id: 3469034
description:
Jan 24 19:17:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.137
country_id: 3469034
description:
Jan 24 19:17:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.123
country_id: 953987
description:
Jan 24 19:18:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.123 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 81.29.142.100
country_id: 2017370
description:
2026-01-24 19:18:30 655834 [Warning] Aborted connection 655834 to db: 'unconnected' user: 'unauthenticated' host: '81.29.142.100' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.119.106
country_id: 732800
description:
Jan 24 19:19:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.119.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:19:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.35.162
country_id: 3469034
description:
Jan 24 19:19:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.35.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.35.162
country_id: 3469034
description:
Jan 24 19:19:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.35.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:20:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.171.52.38
country_id: 587116
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=35131515047305 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 81.29.142.100
country_id: 2017370
description:
2026-01-24 19:21:59 655936 [Warning] Aborted connection 655936 to db: 'unconnected' user: 'unauthenticated' host: '81.29.142.100' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 81.29.142.100
country_id: 2017370
description:
2026-01-24 19:21:59 655937 [Warning] Aborted connection 655937 to db: 'unconnected' user: 'unauthenticated' host: '81.29.142.100' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.120
country_id: 3175395
description:
Jan 24 19:23:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.63
country_id: 3057568
description:
Jan 24 19:24:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.226.117
country_id: 3469034
description:
Jan 24 19:24:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.226.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.226.117
country_id: 3469034
description:
Jan 24 19:25:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.226.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.22.60
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=51101516002847 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.162
country_id: 226074
description:
Jan 24 19:27:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 19:29:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.27.72
country_id: 2658434
description:
Jan 24 19:31:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.27.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:31:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.246
country_id: 3469034
description:
Jan 24 19:31:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.246
country_id: 3469034
description:
Jan 24 19:32:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 19:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55812: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.107.170
country_id: 3469034
description:
Jan 24 19:32:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.107.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.235
country_id: 2300660
description:
Jan 24 19:33:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:33:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.201.209
country_id: 953987
description:
Jan 24 19:33:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.201.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:34:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:36:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.214.135
country_id: 933860
description:
Jan 24 19:36:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.214.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 19:36:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.49.44
country_id: 3469034
description:
Jan 24 19:36:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.49.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.57.143
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=841251 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.182.189.180
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=17431532676481 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:39:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:40:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.139.125.103
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-40.45.139.125.103||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.139
country_id: 1269750
description:
Jan 24 19:42:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 19:41:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.139
country_id: 1269750
description:
Jan 24 19:43:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.35
country_id: 1269750
description:
Jan 24 19:45:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.74.246
country_id: 3469034
description:
Jan 24 19:46:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.74.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.121
country_id: 3469034
description:
Jan 24 19:46:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.27.72
country_id: 2658434
description:
Jan 24 19:46:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.27.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 19:49:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.160.146
country_id: 1269750
description:
Jan 24 19:50:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.227.160.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.162.118
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/exhibition.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.49
country_id: 798544
description:
Jan 24 19:53:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.30.230
country_id: 226074
description:
Jan 24 19:54:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.30.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.177
country_id: 2510769
description:
Jan 24 19:54:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.49
country_id: 798544
description:
Jan 24 19:54:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 19:55:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.177
country_id: 2510769
description:
Jan 24 19:55:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:55:14 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.201.189
country_id: 953987
description:
Jan 24 19:55:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.201.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.124.196.127
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=98641523525547 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 19:56:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.64.135
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=470762 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 19:58:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:58:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:59:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.204.67.24
country_id: 357994
domain: aoto.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.aoto.com.my||ServerName:aoto.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 20:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55834: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:00:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.3.79
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=25 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.101.88.45
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=11 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.143.4
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=5601 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.27.72
country_id: 2658434
description:
Jan 24 20:04:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.27.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.134.140.136
country_id: 6252001
domain: 127.0.0.1
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/127.0.0.1/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 20:06:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.254.130.129
country_id: 1814991
description:
Jan 24 20:06:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.254.130.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.237.77.34
country_id: 1880251
description:
Jan 24 20:08:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.237.77.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 20:09:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.61.199.212
country_id: 6252001
description:
Jan 24 20:10:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.61.199.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-01-24 20:10:17 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (spialiker) [24.61.199.212]:50678: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:13:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.195.2.245
country_id: 1269750
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=705554 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 20:16:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.56.152.243
country_id: 298795
description:
Jan 24 20:16:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.56.152.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.237.77.34
country_id: 1880251
description:
Jan 24 20:16:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.237.77.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.158.227
country_id: 1861060
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/img/slider-images/Cover3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:20:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.88.127.249
country_id: 1835841
description:
Jan 24 20:20:37 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.88.127.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.205.109.219
country_id: 798544
description:
Jan 24 20:20:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.205.109.219 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/es/img/photos/press.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.254.130.129
country_id: 1814991
description:
Jan 24 20:20:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.254.130.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.88.127.249
country_id: 1835841
description:
2026-01-24 20:20:39 dovecot_login authenticator failed for H=([220.88.127.249]) [220.88.127.249]:59829: 535 Incorrect authentication data (set_id=noreply@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.56.152.243
country_id: 298795
description:
Jan 24 20:21:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.56.152.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/awards.php||SC:/home/indfinitydesign/public_html/img/photos/awards.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-24 20:25:05 H=(localhost.localdomain) [78.153.140.207]:52468 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/run/tmpfiles.d/static-nodes.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/products.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 20:26:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.56.152.243
country_id: 298795
description:
Jan 24 20:26:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.56.152.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 20:26:24 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.160.146
country_id: 1269750
description:
Jan 24 20:28:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.227.160.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 20:28:41 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:38355: 535 Incorrect authentication data (set_id=office@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 20:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55875: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:29:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.22.162
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=93 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.253
country_id: 3175395
description:
Jan 24 20:30:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:32:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.156
country_id: 953987
description:
Jan 24 20:32:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.156
country_id: 953987
description:
Jan 24 20:32:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.251
country_id: 1269750
description:
Jan 24 20:33:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:36:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.237.77.34
country_id: 1880251
description:
Jan 24 20:38:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.237.77.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.26
country_id: 3469034
description:
Jan 24 20:37:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.74
country_id: 953987
description:
Jan 24 20:38:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.103.29.83
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/league/flysystem/src/NotSupportedException.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.136.104
country_id: 3175395
description:
Jan 24 20:42:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.136.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.131.55.232
country_id: 1269750
domain: www.ms-chemicals.net
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/nul.AWBWSW5356.cer||User:mschemic||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.136.104
country_id: 3175395
description:
Jan 24 20:43:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.136.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 20:46:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 20:46:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-24 20:46:20 H=(localhost.localdomain) [78.153.140.207]:38354 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-24 20:47:46 +0800] info [cpaneld] 202.178.120.157 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.195
country_id: 3469034
description:
Jan 24 20:49:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.36.248.179
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=967928 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.215.88
country_id: 3469034
description:
Jan 24 20:49:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.215.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.215.88
country_id: 3469034
description:
Jan 24 20:50:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.215.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.42.196
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=2&page_id=1&sub=6 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-24 20:51:13 H=(localhost.localdomain) [78.153.140.207]:50902 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.2
country_id: 953987
description:
Jan 24 20:52:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 24 20:55:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 20:56:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55909: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.26.169
country_id: 3469034
description:
Jan 24 20:56:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.26.169 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.86.131
country_id: 3625428
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/AmqpCaster.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.252.196
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/facilities.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.33
country_id: 3469034
description:
Jan 24 21:01:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.223.91
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14031527237554 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 21:03:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.98.53
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38041515376878 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.96.235.132
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/ConstStub.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.174.225.34
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/hu/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:05:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.27.133.134
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/hu HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.249.171
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/ApacheRequestTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-24 21:06:17 +0800] info [cpaneld] 202.178.120.157 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.221.78.73
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:08:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.50.189.190
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=86361516002399 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:17:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 21:18:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.226.27.227
country_id: 294640
description:
Jan 24 21:17:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.226.27.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-01-24 21:18:01 dovecot_plain authenticator failed for H=(reies) [109.226.27.227]:41422: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:18:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 21:19:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 8.138.154.105
country_id: 1814991
description:
2026-01-24 21:19:49 660004 [Warning] Aborted connection 660004 to db: 'unconnected' user: 'unauthenticated' host: '8.138.154.105' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 21:20:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.135.10
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25311526631175 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.78.162
country_id: 3469034
description:
Jan 24 21:23:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.78.162
country_id: 3469034
description:
Jan 24 21:24:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 21:24:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59084: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.78
country_id: 2510769
description:
Jan 24 21:24:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.211
country_id: 3469034
description:
Jan 24 21:25:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.3.190
country_id: 1269750
description:
Jan 24 21:25:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.112
country_id: 3057568
description:
Jan 24 21:27:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.49
country_id: 3865483
description:
Jan 24 21:27:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.173
country_id: 953987
description:
Jan 24 21:29:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.190
country_id: 2300660
description:
Jan 24 21:29:29 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.190 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.57.43.249
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-30.31.57.43.249||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 21:30:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.191.236.220
country_id: 3469034
description:
Jan 24 21:31:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.191.236.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.202
country_id: 6252001
description:
Jan 24 21:31:07 sv3 pure-ftpd[3279122]: (?@167.94.138.202) [INFO] New connection from 167.94.138.202


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-24 21:31:33 H=(localhost.localdomain) [78.153.140.207]:40160 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.191.236.220
country_id: 3469034
description:
Jan 24 21:32:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.191.236.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.47
country_id: 798544
description:
Jan 24 21:32:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:34:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 21:36:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.119
country_id: 6252001
description:
2026-01-24 21:36:13 660573 [Warning] Aborted connection 660573 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.119' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 21:38:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 21:39:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:39:41 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 21:40:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 21:40:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.121.156
country_id: 3865483
description:
Jan 24 21:41:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.121.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.100.90.134
country_id: 732800
description:
Jan 24 21:41:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.100.90.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.100.90.134
country_id: 732800
description:
Jan 24 21:42:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.100.90.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:44:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/78.0.3904.70 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 21:45:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.88.108.81
country_id: 2328926
description:
[2026-01-24 21:47:15 +0800] info [webmaild] 102.88.108.81 - boonpau.tan@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.48.157.56
country_id: 3865483
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/product-details.php?id=992414 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 194.41.120.239
country_id: 2635167
domain: www.feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/certificate.php||SC:/home2/feliogroupcom/public_html/images/certificate.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 139.28.122.162
country_id: 2635167
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/product.php||SC:/home2/feliogroupcom/public_html/images/product.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.44.201.154
country_id: 690791
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=90 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 152.39.139.101
country_id: 6252001
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/contact.php||SC:/home2/feliogroupcom/public_html/images/contact.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 193.42.56.176
country_id: 2635167
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/index.php||SC:/home2/feliogroupcom/public_html/images/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 162.43.233.208
country_id: 6252001
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/about.php||SC:/home2/feliogroupcom/public_html/images/about.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.71.105.198
country_id: 3469034
domain: box.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94381.box.my||ServerName:box.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb166f3e24f43ba754706d223a0b116e2aa5b07b||Title:0xb9508123||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 21:52:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55831: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.229
country_id: 1269750
description:
Jan 24 21:53:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 21:53:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.71.105.198
country_id: 3469034
domain: box.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:49505.box.com.my||ServerName:box.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c08e50e11825a2e20130a824308ffdd23eae4932||Title:0xef3b39bf||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.220.190
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25011514882695 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.35.33
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=443235 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.116
country_id: 2395170
description:
Jan 24 22:03:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.9.9
country_id: 2300660
description:
Jan 24 22:03:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.9.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 22:04:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.116
country_id: 2395170
description:
Jan 24 22:04:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.9.9
country_id: 2300660
description:
Jan 24 22:04:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.9.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.101.194.172
country_id: 690791
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=434148 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.108.242
country_id: 3469034
description:
Jan 24 22:08:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.108.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 22:08:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.131.2
country_id: 3608932
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-09.191.102.131.2||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.52.133.243
country_id: 3437598
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=360128 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.190.96.234
country_id: 3469034
description:
Jan 24 22:13:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.190.96.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 22:14:29 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:38246: 535 Incorrect authentication data (set_id=help@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/keyword/img/private-residence.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.205.35
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=22 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.204.23.4
country_id: 6252001
description:
Jan 24 22:15:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.204.23.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.195
country_id: 3469034
description:
Jan 24 22:16:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.125
country_id: 3469034
description:
Jan 24 22:17:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.57
country_id: 798544
description:
Jan 24 22:17:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.193.127
country_id: 1814991
description:
Jan 24 22:20:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.193.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-01-24 22:20:24 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:34997: 535 Incorrect authentication data (set_id=help@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 22:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55878: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 22:20:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 22:20:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.10.210.68
country_id: 732800
description:
Jan 24 22:21:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.10.210.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2026-01-24 22:21:24 dovecot_plain authenticator failed for H=(lationg) [46.10.210.68]:57983: 535 Incorrect authentication data (set_id=vsloh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 22:21:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.84
country_id: 3469034
description:
Jan 24 22:23:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.161.72
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-24.166.0.161.72||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.77.8.203
country_id: 1861060
description:
Jan 24 22:25:29 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.77.8.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 22:27:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.148.73
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97471515379533 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 22:28:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.187.162
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=670535 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 22:33:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 24 22:34:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.113.44
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=174516 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.62.116.11
country_id: 3439705
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=48691516782865 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.72.28
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=34&sub=91 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.78.140.118
country_id: 2802361
description:
2026-01-24 22:41:38 663000 [Warning] Aborted connection 663000 to db: 'unconnected' user: 'unauthenticated' host: '34.78.140.118' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.78.140.118
country_id: 2802361
description:
2026-01-24 22:42:21 663285 [Warning] Aborted connection 663285 to db: 'unconnected' user: 'unauthenticated' host: '34.78.140.118' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.2.249.160
country_id: 3469034
description:
Jan 24 22:43:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.2.249.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.96.161
country_id: 3865483
description:
Jan 24 22:44:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.96.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 24 22:44:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.2.249.160
country_id: 3469034
description:
Jan 24 22:44:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.2.249.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.75.122
country_id: 690791
description:
Jan 24 22:44:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.75.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.252.173
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/product-category.php?id=5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.94
country_id: 732800
description:
Jan 24 22:45:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.149.227.12
country_id: 1269750
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/variousactivities.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 22:48:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55901: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 145.223.59.128
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-49.145.223.59.128||RSV:7.67||T:APACHE||


plugin: cl_dos
name: DOS detection
abuser: 152.53.52.160
country_id: 6252001
description:
2026-01-24 22:51:48.01375265 +0800 +08 m=+688196.247193055 Denial of Service attack was discovered from 152.53.52.160, on port 443. Open connections: 475


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.159.75
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=381667 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.20.50
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=70&page=3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.109.92.55
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=600737 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 22:55:37 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 22:57:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 22:58:41 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.206.70.75
country_id: 1831722
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/video.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:01:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.37.77.227
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=71251516863446 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.34.199
country_id: 6252001
description:
Jan 24 23:07:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.34.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:08:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.34.199
country_id: 6252001
description:
Jan 24 23:08:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.34.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:10:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.232.119.77
country_id: 2921044
description:
Jan 24 23:11:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.232.119.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.97.109.192
country_id: 1835841
description:
Jan 24 23:12:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.97.109.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
country_id: 1835841
description:
2026-01-24 23:13:00 dovecot_login authenticator failed for H=([210.97.109.192]) [210.97.109.192]:52634: 535 Incorrect authentication data (set_id=orders@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.232.119.77
country_id: 2921044
description:
Jan 24 23:13:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.232.119.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 221.199.73.233
country_id: 1814991
description:
Jan 24 23:14:42 sv3 pure-ftpd[3343518]: (?@221.199.73.233) [INFO] New connection from 221.199.73.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 24 23:14:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-24 23:14:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:65485: 535 Incorrect authentication data (set_id=volgograd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 23:14:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
country_id: 3469034
description:
Jan 24 23:15:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-24 23:15:07 dovecot_login authenticator failed for H=(189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:60239: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 23:16:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55938: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.0.24.177
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/hotel.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 23:18:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-01-24 23:19:13 +0800] info [cpaneld] 103.210.132.14 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:20:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 150.228.189.205
country_id: 1694008
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/run/systemd/system.control/imunify360-agent.service.d/50-CPUQuota.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.29.221.123
country_id: 3439705
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=92 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.30.139.241
country_id: 1694008
description:
2026-01-24 23:26:53 dovecot_plain authenticator failed for H=(DRACO.tail1faf7e.ts.net) [149.30.139.241]:51129: 535 Incorrect authentication data (set_id=kevinliau@medigo.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:26:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.30.139.241
country_id: 1694008
description:
Jan 24 23:26:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.30.139.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.160
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-26.92.71.72.160||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 24 23:27:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-24 23:27:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:50938: 535 Incorrect authentication data (set_id=wts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.30.139.241
country_id: 1694008
description:
2026-01-24 23:26:59 dovecot_login authenticator failed for H=(DRACO.tail1faf7e.ts.net) [149.30.139.241]:51129: 535 Incorrect authentication data (set_id=kevinliau@medigo.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.26.147
country_id: 798544
description:
Jan 24 23:27:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.26.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 24 23:27:29 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:27:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.199
country_id: 6252001
description:
Jan 24 23:30:25 sv3 pure-ftpd[3353970]: (?@162.142.125.199) [INFO] New connection from 162.142.125.199


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 23:31:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.239.104
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=87811515566080 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:35:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:38:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-24 23:40:41 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63376: 535 Incorrect authentication data (set_id=script)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 24 23:40:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 156.241.212.216
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-41.156.241.212.216||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:44:41 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 23:44:59 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:37126: 535 Incorrect authentication data (set_id=finance@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.122.81.39
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/ramsey/uuid/CODE_OF_CONDUCT.md HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.140.167.69
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74351515570613 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 24 23:48:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.8
country_id: 690791
description:
Jan 24 23:50:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 199.34.88.5
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-51.199.34.88.5||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.8
country_id: 690791
description:
Jan 24 23:50:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.249.53.31
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-52.104.249.53.31||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.88.92
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=79591514882509 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 24 23:53:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.96.55.37
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-53.116.96.55.37||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-24 23:53:59 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57057: 535 Incorrect authentication data (set_id=asd)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.204.244
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-55.171.224.204.244||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.170
country_id: 6252001
description:
Jan 24 23:57:28 sv3 pure-ftpd[3372198]: (?@205.210.31.170) [INFO] New connection from 205.210.31.170


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.61.203
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/admin/clients/index.blade.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:00:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 00:01:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.81.54
country_id: 1269750
description:
Jan 25 00:02:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.81.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:05:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 00:06:49 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60454: 535 Incorrect authentication data (set_id=B'Trey)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.242
country_id: 6252001
description:
2026-01-25  0:06:02 666587 [Warning] Aborted connection 666587 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.242' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/asia/images/tyresafetytips.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.47.83.21
country_id: 732800
description:
Jan 25 00:08:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.47.83.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.8
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/pt/index.db||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.3
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/dnf/packages.db||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.222
country_id: 226074
description:
Jan 25 00:10:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 00:10:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.159.91.180
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteColumnStackedChart2.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.211.80.153
country_id: 1522867
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/Controller HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.133.122
country_id: 719819
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/Controller/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 00:13:26 H=([45.144.212.242]) [45.144.212.242]:65198 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.98
country_id: 226074
description:
Jan 25 00:15:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.196
country_id: 3996063
description:
Jan 25 00:16:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.147.60
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=872055 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.171.206
country_id: 1210997
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.108.55
country_id: 3469034
description:
Jan 25 00:18:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.108.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 00:19:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.125
country_id: 3469034
description:
Jan 25 00:19:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:19:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.35
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/c-bible/images/resource/index.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.136.83
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=60091516587529 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.85
country_id: 3469034
description:
Jan 25 00:19:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 00:19:59 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56278: 535 Incorrect authentication data (set_id=ike)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.85
country_id: 3469034
description:
Jan 25 00:20:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.6.71
country_id: 2395170
description:
Jan 25 00:23:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.6.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.235
country_id: 2300660
description:
Jan 25 00:23:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.133.200
country_id: 690791
description:
Jan 25 00:23:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.133.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.251
country_id: 1269750
description:
Jan 25 00:23:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.54
country_id: 3469034
description:
Jan 25 00:23:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.180
country_id: 798544
description:
Jan 25 00:23:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.155
country_id: 3175395
description:
Jan 25 00:23:33 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.126
country_id: 953987
description:
Jan 25 00:23:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.30
country_id: 3175395
description:
Jan 25 00:24:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.126
country_id: 953987
description:
Jan 25 00:23:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.0.180.43
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-25.117.0.180.43||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.171
country_id: 3175395
description:
Jan 25 00:26:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.24.182.58
country_id: 1269750
description:
Jan 25 00:27:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.24.182.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 00:28:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.0.0.50
country_id: 3469034
description:
Jan 25 00:28:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.0.0.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:32:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.105.252
country_id: 1269750
description:
Jan 25 00:33:37 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.105.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 00:33:41 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 00:33:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:59215: 535 Incorrect authentication data (set_id=sks)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.154.16
country_id: 690791
description:
Jan 25 00:34:24 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.154.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.54
country_id: 3175395
description:
Jan 25 00:34:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.54
country_id: 3175395
description:
Jan 25 00:35:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.66
country_id: 298795
description:
Jan 25 00:35:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.102.9.144
country_id: 3469034
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/recond/wp-content/themes/cordobo-green-park-2/img/top-sprite.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:39:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.29
country_id: 953987
description:
Jan 25 00:41:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.75
country_id: 933860
description:
Jan 25 00:42:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 38.80.62.78
country_id: 1269750
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/61-urw-z003.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.98.42
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=39921515046027 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.184.172.67
country_id: 1210997
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/1568199212.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.234.178
country_id: 1562822
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/5730437046.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.123.81.11
country_id: 248816
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/1611853303.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.228.240
country_id: 3437598
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/6125494826.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.118.248
country_id: 1562822
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/4029879185.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.128.246.221
country_id: 690791
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/4012497733.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.64.22.19
country_id: 1522867
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/8239495639.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.151.175.151
country_id: 3865483
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/6370697018.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.244.156.32
country_id: 2464461
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/www.google-analytics.com/analytics.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.204.211.71
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=849737 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.189.31.168
country_id: 3865483
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/product.php?page=96 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.246.131
country_id: 248816
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/jquery.easing.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.10.182
country_id: 1562822
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/7834857109.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.200.4.122
country_id: 1269750
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/9540148620.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.171.169
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=881760 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.172.167
country_id: 192950
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/6812744878.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.151.119.108
country_id: 3595528
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/3147220600.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.13
country_id: 798544
description:
Jan 25 00:48:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 00:48:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 00:48:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:54175: 535 Incorrect authentication data (set_id=benz)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib64/cracklib_dict.pwd||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:49:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.61.238
country_id: 1819730
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/assets/pic/0.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.85
country_id: 6252001
description:
2026-01-25  0:51:19 668054 [Warning] Aborted connection 668054 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.85' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.29.44
country_id: 3624060
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=578354 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.48.57
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-52.45.3.48.57||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.48.3
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-52.45.3.48.3||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.213.165.132
country_id: 2921044
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-52.154.213.165.132||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.116
country_id: 6252001
description:
Jan 25 00:52:25 sv3 pure-ftpd[3405255]: (?@198.235.24.116) [INFO] New connection from 198.235.24.116


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.44.218
country_id: 2510769
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-52.45.3.44.218||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/lkwconstructions/mysql.sql||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.76.241.47
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=453297 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.17
country_id: 3175395
description:
Jan 25 00:58:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.230
country_id: 1269750
description:
Jan 25 00:58:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/acburnco/homedir/etc/acburnco.rcube.db||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.24.207
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=40431514882203 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/acburnco/homedir/etc/acburn.com.my/sales.rcube.db||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.78.204
country_id: 3469034
description:
Jan 25 01:01:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.78.204 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/acburnco/homedir/mail/dovecot.mailbox.log||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 01:02:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.33.97
country_id: 660013
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/G09-051 -Lami PP 2-150x150.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.33.97
country_id: 660013
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/G09-051 -Lami PP 2-150x150.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 01:02:33 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 01:02:35 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61109: 535 Incorrect authentication data (set_id=adonix)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.243
country_id: 6252001
description:
2026-01-25  1:04:55 668414 [Warning] Aborted connection 668414 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.243' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.98.222.146
country_id: 3865483
description:
Jan 25 01:09:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.98.222.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 01:09:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 25 01:10:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 01:10:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.177
country_id: 953987
description:
Jan 25 01:11:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.177
country_id: 953987
description:
Jan 25 01:12:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.43.230.6
country_id: 798544
description:
Jan 25 01:12:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.43.230.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2026-01-25 01:12:15 dovecot_plain authenticator failed for H=cm-72-241-202-104.buckeyecom.net (epdoak) [72.241.202.104]:38766: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 25 01:13:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.135.240
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=599376 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.228.32.34
country_id: 1814991
description:
Jan 25 01:15:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.228.32.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
country_id: 1814991
description:
2026-01-25 01:15:02 dovecot_login authenticator failed for H=([124.228.32.34]) [124.228.32.34]:41814: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.238
country_id: 2300660
description:
Jan 25 01:17:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 01:17:12 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 01:17:14 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56027: 535 Incorrect authentication data (set_id=sftpuser)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.150
country_id: 3865483
description:
Jan 25 01:18:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.178
country_id: 3469034
description:
Jan 25 01:18:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/named.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.143
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/c-bible/images/resource/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.6
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/tmp.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.150
country_id: 3865483
description:
Jan 25 01:19:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.229.177
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=52 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.13.61.56
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=15211514884198 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.166
country_id: 1269750
description:
Jan 25 01:25:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.136
country_id: 3469034
description:
Jan 25 01:25:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.166
country_id: 1269750
description:
Jan 25 01:26:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 01:26:19 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 01:27:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.141
country_id: 6252001
description:
Jan 25 01:29:05 sv3 pure-ftpd[3426598]: (?@198.235.24.141) [INFO] New connection from 198.235.24.141


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.106.240
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=735818 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 01:31:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 01:31:18 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57374: 535 Incorrect authentication data (set_id=save)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.223.118.100
country_id: 1522867
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=299091 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.126
country_id: 3469034
description:
Jan 25 01:38:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.132.238
country_id: 3175395
description:
Jan 25 01:38:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.132.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.180
country_id: 953987
description:
Jan 25 01:39:33 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.88.3
country_id: 3469034
description:
Jan 25 01:39:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.88.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.126
country_id: 3469034
description:
Jan 25 01:39:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.134
country_id: 1269750
description:
Jan 25 01:39:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.88.3
country_id: 3469034
description:
Jan 25 01:40:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.88.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 01:41:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.96.176.109
country_id: 3469034
domain: www.ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.108.98.162
country_id: 294640
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/news-detail.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.28.28
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=212395 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 01:45:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 01:45:28 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:53167: 535 Incorrect authentication data (set_id=badin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.149.12
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=222966 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.20.251.208
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=192351 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.112.151.20
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=942713 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.17.225
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=4&page_id=1&sub=3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 01:47:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.61.245.162
country_id: 2017370
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/finder/Iterator/CustomFilterIterator.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.235.253
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=28 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.2.49
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.151
country_id: 1733045
description:
[2026-01-25 01:48:34 +0800] info [webmaild] 161.142.118.151 - s-osada@mckd.com.my "GET /cpsess6293287042/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.171.210
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=794941 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/symphonyadmin/mysql/symphony_live.sql||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/symphonyadmin/homedir/symphony_live.sql||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/symphonyadmin/homedir/etc/symphony-led.com/account.rcube.db||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.236.113.34
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=19 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.166.251.251
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=7 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.165.118
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.165.222.152
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=1&sub=13 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.201.206.151
country_id: 3686110
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/EmailValidator/EmailParser.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.128.141
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/index.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.112.89
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=7&page_id=1&sub=42 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.227.55.27
country_id: 2464461
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=135803 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.148.34
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/teamwork.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/symphonyadmin/mysql.sql||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.196.201.145
country_id: 3996063
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=308206 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/symphonyadmin/userdata/symphony-led.com||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.242.162.102
country_id: 953987
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=1816520570 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.145.161
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=268452 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.76.148
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=697884 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/tptecadmin/mysql.sql||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 02:00:24 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:59064: 535 Incorrect authentication data (set_id=ldapauth)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.63.199
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=444310 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.211.149
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.188.79.205
country_id: 3996063
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=27 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 02:00:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/webhost/mysql/webhost_wp_enoprint.sql||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.161.17.128
country_id: 3996063
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=224566 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.84.216
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=18 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/webhost/mysql/webhost_wp458.sql||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/about.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/thinkcloudadmin/mysql/thinkcloudadmin_db.sql||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 151.80.20.75
country_id: 3017382
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-03.151.80.20.75||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/egbwawasancom/mysql.sql||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 151.80.20.75
country_id: 3017382
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-04.151.80.20.75||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/chokeeintcom/mysql/chokeeintcom_wp_upuxy.sql||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.243.164.163
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/oriental.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.44.31.170
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2856 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.168
country_id: 1269750
description:
Jan 25 02:08:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-01-25 02:08:56 dovecot_login authenticator failed for H=(nsg-corporate-168.229.187.122.airtel.in) [122.187.229.168]:54406: 535 Incorrect authentication data (set_id=press@kimmark.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.233.161
country_id: 2993457
description:
Jan 25 02:10:39 sv3 pure-ftpd[3449879]: (?@95.181.233.161) [INFO] New connection from 95.181.233.161


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 95.134.63.74
country_id: 2921044
description:
2026-01-25  2:10:38 670612 [Warning] Aborted connection 670612 to db: 'unconnected' user: 'unauthenticated' host: '95.134.63.74' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 02:14:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 02:14:29 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:64077: 535 Incorrect authentication data (set_id=pergamum)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.154.231.7
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=672005 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.198.13.105
country_id: 241170
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-17.196.198.13.105||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.255.47
country_id: 798544
description:
Jan 25 02:17:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.255.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.255.47
country_id: 798544
description:
Jan 25 02:18:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.255.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.198.123
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=759894 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.126
country_id: 2300660
description:
Jan 25 02:18:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.126
country_id: 2300660
description:
Jan 25 02:18:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.24
country_id: 298795
description:
Jan 25 02:19:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.252
country_id: 690791
description:
Jan 25 02:21:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.252
country_id: 690791
description:
Jan 25 02:22:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 25 02:28:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.244.218
country_id: 3865483
description:
Jan 25 02:28:41 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.244.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 02:29:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 02:29:51 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63753: 535 Incorrect authentication data (set_id=jiang)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.2
country_id: 1269750
description:
Jan 25 02:29:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 02:29:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.48.112
country_id: 2017370
domain: nexuscollection.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-30.109.248.48.112||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.118.74
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=22861516002507 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 25 02:34:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.180
country_id: 1269750
description:
Jan 25 02:36:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.249.41.218
country_id: 2542007
description:
Jan 25 02:37:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.249.41.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.249.41.218
country_id: 2542007
description:
2026-01-25 02:37:52 dovecot_plain authenticator failed for H=([192.168.1.7]) [41.249.41.218]:65422: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.87.207.149
country_id: 6252001
description:
Jan 25 02:38:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.87.207.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.212.51.241
country_id: 630336
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product-detail.php?id=5080364288 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 02:42:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.174
country_id: 3469034
description:
Jan 25 02:43:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 02:44:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 02:44:56 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:64164: 535 Incorrect authentication data (set_id=erdw)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.235.151
country_id: 3175395
description:
Jan 25 02:46:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.85
country_id: 2510769
description:
Jan 25 02:48:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.85
country_id: 2510769
description:
Jan 25 02:49:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.36
country_id: 798544
description:
Jan 25 02:49:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.119.250
country_id: 226074
description:
Jan 25 02:49:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.119.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.87.207.149
country_id: 6252001
description:
Jan 25 02:50:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.87.207.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-25 02:52:08 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:58900: 535 Incorrect authentication data (set_id=team@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.150.82
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95561520648895 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.87.207.149
country_id: 6252001
description:
Jan 25 02:54:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.87.207.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.78.146
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-54.92.71.78.146||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 188.130.186.136
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-55.188.130.186.136||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.70.109
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-56.142.111.70.109||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.247.63
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=91851514942605 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.51
country_id: 6252001
description:
Jan 25 02:57:49 sv3 pure-ftpd[3476361]: (?@147.185.132.51) [INFO] New connection from 147.185.132.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.183.86
country_id: 3469034
description:
Jan 25 02:58:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.183.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 03:00:29 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:52710: 535 Incorrect authentication data (set_id=AB\023)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 03:03:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.204.116.36
country_id: 6252001
domain: symphony-led.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.224 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.197
country_id: 1269750
description:
Jan 25 03:05:33 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 25 03:05:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.132
country_id: 6290252
description:
Jan 25 03:05:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.132 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 152.32.213.168
country_id: 1819730
description:
2026-01-25  3:05:01 672416 [Warning] Aborted connection 672416 to db: 'unconnected' user: 'unauthenticated' host: '152.32.213.168' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.132
country_id: 6290252
description:
Jan 25 03:06:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 92.40.177.58
country_id: 2635167
domain: af-sb.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.156.11.17
country_id: 6252001
description:
Jan 25 03:07:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.156.11.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 92.40.177.58
country_id: 2635167
domain: af-sb.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.67||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.227.18.30
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739548 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.156.11.17
country_id: 6252001
description:
Jan 25 03:08:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.156.11.17 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.134.230
country_id: 6252001
description:
2026-01-25  3:10:43 672590 [Warning] Aborted connection 672590 to db: 'unconnected' user: 'unauthenticated' host: '71.6.134.230' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.207.17
country_id: 953987
description:
Jan 25 03:11:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.207.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.207.17
country_id: 953987
description:
Jan 25 03:12:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.207.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.74.192.74
country_id: 298795
description:
Jan 25 03:12:19 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.74.192.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 03:15:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 03:15:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:51302: 535 Incorrect authentication data (set_id=fd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.106.18
country_id: 226074
description:
Jan 25 03:15:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.106.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.106.18
country_id: 226074
description:
Jan 25 03:16:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.106.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.133.157
country_id: 3865483
description:
Jan 25 03:16:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.133.157 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.54.25.143
country_id: 458258
description:
86.54.25.143 - - [25/Jan/2026:03:22:26 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7312582&pdata=https%253A%252F%252Fmail.tujusetia.my%253A2096%252Fwebmaillogout.cgi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769282544 HTTP/2.0" 302 0 mail.tujusetia.my "https://mail.tujusetia.my:2096/webmaillogout.cgi" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.54.25.143


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.54.25.143
country_id: 458258
description:
[2026-01-25 03:22:29 +0800] info [webmaild] 86.54.25.143 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.125
country_id: 617790
domain: maalloys.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_66) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/94.0.4606.61 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.187.22
country_id: 1269750
description:
Jan 25 03:27:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.187.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.22
country_id: 1269750
description:
2026-01-25 03:27:28 dovecot_plain authenticator failed for H=(secia) [182.95.187.22]:46632: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 03:29:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 03:29:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:51205: 535 Incorrect authentication data (set_id=counter)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.177.36
country_id: 298795
description:
Jan 25 03:29:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.177.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.199
country_id: 3469034
description:
Jan 25 03:30:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.173
country_id: 3469034
description:
Jan 25 03:30:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.177.36
country_id: 298795
description:
Jan 25 03:30:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.177.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.81.226
country_id: 1269750
description:
Jan 25 03:31:12 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.81.226 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.218.240.172
country_id: 1819730
description:
2026-01-25  3:32:22 673299 [Warning] Aborted connection 673299 to db: 'unconnected' user: 'unauthenticated' host: '103.218.240.172' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.168
country_id: 1269750
description:
Jan 25 03:33:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.73.127
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-33.50.117.73.127||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.107.168.5
country_id: 2635167
description:
Jan 25 03:34:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.107.168.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.107.168.5
country_id: 2635167
description:
2026-01-25 03:34:22 dovecot_plain authenticator failed for H=([109.107.168.5]) [109.107.168.5]:59590: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.101
country_id: 6252001
description:
2026-01-25  3:35:55 673383 [Warning] Aborted connection 673383 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.101' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.79.238
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-42.92.71.79.238||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.230.40
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=234981 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 03:44:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 03:44:12 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61989: 535 Incorrect authentication data (set_id=serveur)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.121.11.105
country_id: 953987
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/chalk/13/172/1353973 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.132
country_id: 3469034
description:
Jan 25 03:45:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.9
country_id: 3175395
description:
Jan 25 03:46:19 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.132
country_id: 3469034
description:
Jan 25 03:46:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.149.194
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=526194 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.26.236
country_id: 798544
description:
Jan 25 03:47:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.26.236 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.206.48.164
country_id: 2542007
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=22681514863685 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.235
country_id: 798544
description:
Jan 25 03:52:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.1
country_id: 953987
description:
Jan 25 03:52:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.126
country_id: 3469034
description:
Jan 25 03:54:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.126
country_id: 3469034
description:
Jan 25 03:55:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-25 03:55:30 H=([77.83.39.92]) [77.83.39.92]:57434 F=<MeshaMatar@proton.me> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.39.31.246
country_id: 3077311
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-56.45.39.31.246||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/images/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.220
country_id: 1269750
description:
Jan 25 03:58:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.153
country_id: 1269750
description:
Jan 25 03:58:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 03:59:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 03:59:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61347: 535 Incorrect authentication data (set_id=qw)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.121.51.247
country_id: 1668284
description:
2026-01-25 03:59:23 H=([45.121.51.247]) [45.121.51.247]:59776 F=<huntington-alerts@huntington.net> rejected RCPT <sales@webhosting2u.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 03:59:24 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.54.232.6
country_id: 6252001
domain: hmz.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-00.142.54.232.6||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.42.178.49
country_id: 1269750
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=185808 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/testimonial.php||SC:/home/indfinitydesign/public_html/images/testimonial.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.109.163.62
country_id: 3625428
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/hu/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.67.38.54
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/hu HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 106.75.164.40
country_id: 1814991
description:
2026-01-25  4:04:36 674378 [Warning] Aborted connection 674378 to db: 'unconnected' user: 'unauthenticated' host: '106.75.164.40' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-25 04:07:56 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:49331: 535 Incorrect authentication data (set_id=webmaster@tujusetia.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.193
country_id: 6252001
description:
2026-01-25  4:07:27 674459 [Warning] Aborted connection 674459 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.193' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.161.144
country_id: 6252001
description:
Jan 25 04:09:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.161.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-01-25 04:09:50 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (terific) [73.199.161.144]:53468: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.96.57.220
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-11.116.96.57.220||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.220.193
country_id: 3469034
description:
Jan 25 04:12:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.220.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.216
country_id: 3865483
description:
Jan 25 04:13:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 04:14:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 04:14:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56917: 535 Incorrect authentication data (set_id=read)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.145.57.168
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/clients.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.191.189.219
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=898173 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.4
country_id: 2395170
description:
Jan 25 04:19:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.67
country_id: 3469034
description:
Jan 25 04:20:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.49.146
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-20.198.145.49.146||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.125
country_id: 6252001
description:
Jan 25 04:21:39 sv3 pure-ftpd[3530818]: (?@167.94.138.125) [INFO] New connection from 167.94.138.125


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.176.180.253
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.234.180.130
country_id: 3686110
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/ExpressionRequestMatcherTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.200.141
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-25.171.224.200.141||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.166
country_id: 2993457
description:
Jan 25 04:28:08 sv3 pure-ftpd[3538834]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 04:29:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 04:29:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:53168: 535 Incorrect authentication data (set_id=movil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/monthly-report.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.79
country_id: 1269750
description:
Jan 25 04:37:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.43
country_id: 798544
description:
Jan 25 04:37:29 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.79
country_id: 1269750
description:
Jan 25 04:38:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.32
country_id: 3077311
description:
Jan 25 04:38:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 04:39:08 H=([45.144.212.242]) [45.144.212.242]:53839 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.241
country_id: 3469034
description:
Jan 25 04:39:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.70
country_id: 3865483
description:
Jan 25 04:39:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.97.209
country_id: 3865483
description:
Jan 25 04:40:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.97.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.126.174
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/filp/whoops/src/Whoops/Run.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.146.195
country_id: 690791
description:
Jan 25 04:41:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.146.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.230
country_id: 3469034
description:
Jan 25 04:41:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.94.239.55
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravelcollective/html/src/FormBuilder.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 04:44:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 04:44:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57849: 535 Incorrect authentication data (set_id=cap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.235
country_id: 3469034
description:
Jan 25 04:46:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.214.113
country_id: 2921044
description:
Jan 25 04:46:34 sv3 pure-ftpd[3553500]: (?@68.183.214.113) [INFO] New connection from 68.183.214.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.43
country_id: 3865483
description:
Jan 25 04:46:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.84
country_id: 690791
description:
Jan 25 04:47:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.189.61
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=340379 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/faq.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.84
country_id: 690791
description:
Jan 25 04:48:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.185.109.151
country_id: 6251999
domain: af-sb.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-49.190.185.109.151||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.88.178
country_id: 2921044
description:
Jan 25 04:51:53 sv3 pure-ftpd[3555876]: (?@134.122.88.178) [INFO] New connection from 134.122.88.178


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.211.33
country_id: 6252001
description:
2026-01-25 04:53:29 H=([158.94.211.33]) [158.94.211.33]:55232 F=<Nencia1@outlook.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 158.94.211.33 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.74.228
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=518721 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.104.207
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-56.146.103.104.207||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 04:57:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 04:57:33 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:52140: 535 Incorrect authentication data (set_id=sda)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.141
country_id: 953987
description:
Jan 25 05:03:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.135
country_id: 3469034
description:
Jan 25 05:03:33 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.78
country_id: 3469034
description:
Jan 25 05:05:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:08:26 dovecot_login authenticator failed for H=(ULDgV4) [185.169.4.24]:57584: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.21.13.251
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-08.185.21.13.251||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.185
country_id: 3469034
description:
Jan 25 05:09:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.173
country_id: 3469034
description:
Jan 25 05:09:47 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:09:15 dovecot_login authenticator failed for H=(5I3sdq0Lwf) [185.169.4.24]:57343: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.173
country_id: 3469034
description:
Jan 25 05:10:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.214.29
country_id: 933860
description:
Jan 25 05:10:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.214.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:10:06 dovecot_login authenticator failed for H=(KnLDnLHsaI) [185.169.4.24]:50278: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.78.71
country_id: 3686110
description:
Jan 25 05:11:17 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.78.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:11:19 dovecot_login authenticator failed for H=(dBAwKVJW) [185.169.4.24]:61383: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 05:11:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 05:11:44 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56759: 535 Incorrect authentication data (set_id=lori)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.152.218
country_id: 690791
description:
Jan 25 05:11:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.152.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:12:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate_chaah@ajplantations.com.my has been locked for the attacker IP 185.169.4.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 25 05:12:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:12:13 dovecot_login authenticator failed for H=(vzDYzK) [185.169.4.24]:62002: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-25 05:12:30 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:38258: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.152.218
country_id: 690791
description:
Jan 25 05:12:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.152.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:13:02 dovecot_login authenticator failed for H=(Xo2MLUQY) [185.169.4.24]:55299: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:13:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:13:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate_chaah@ajplantations.com.my has been locked for the attacker IP 185.169.4.24


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 69.62.166.196
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/45-generic.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:14:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:14:17 dovecot_login authenticator failed for H=(PGQY2fL) [185.169.4.24]:55202: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:15:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:15:11 dovecot_login authenticator failed for H=(l8vjeFL9x) [185.169.4.24]:49718: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:16:04 dovecot_login authenticator failed for H=(jVyC6G) [185.169.4.24]:57120: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 05:16:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:16:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.188.82.95
country_id: 6252001
domain: ocned.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/ocned.com/news.php?i=10 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:17:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:17:18 dovecot_login authenticator failed for H=(ZT6rQS) [185.169.4.24]:59216: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:18:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:18:09 dovecot_login authenticator failed for H=(I3RgmtT) [185.169.4.24]:56064: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:19:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:19:24 dovecot_login authenticator failed for H=(JxNkpWgP) [185.169.4.24]:51944: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.238.244
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-19.108.165.238.244||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:20:11 dovecot_login authenticator failed for H=(8ht2fYsg) [185.169.4.24]:53392: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:20:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:21:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:21:24 dovecot_login authenticator failed for H=(vSGs3vY) [185.169.4.24]:51476: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:22:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:22:13 dovecot_login authenticator failed for H=(Q6fh03jM) [185.169.4.24]:52764: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.101.240.128
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-25 05:23:09 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:42207: 535 Incorrect authentication data (set_id=security@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:23:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.101.240.128
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:tuju7822||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:23:02 dovecot_login authenticator failed for H=(8MXqfs) [185.169.4.24]:62977: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Jan 25 05:23:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:24:14 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:24:16 dovecot_login authenticator failed for H=(1BCDZyjP) [185.169.4.24]:54434: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:25:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:25:05 dovecot_login authenticator failed for H=(SwdSETG) [185.169.4.24]:51321: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 05:25:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 05:25:46 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60058: 535 Incorrect authentication data (set_id=aip)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:26:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:26:18 dovecot_login authenticator failed for H=(0byWCKwQPm) [185.169.4.24]:52763: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:27:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:27:07 dovecot_login authenticator failed for H=(kxlPDMwjs) [185.169.4.24]:60702: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:28:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:28:20 dovecot_login authenticator failed for H=(xypICUt0) [185.169.4.24]:53901: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:29:09 dovecot_login authenticator failed for H=(xuUfV7i) [185.169.4.24]:62842: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:29:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:30:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:30:20 dovecot_login authenticator failed for H=(hc0qrFdo) [185.169.4.24]:62833: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/imunify360/imunify360-ipsetlists.db||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.229.106.161
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-34.138.229.106.161||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.45
country_id: 6252001
description:
2026-01-25  5:35:28 677780 [Warning] Aborted connection 677780 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.45' (This connection closed normally without authentication)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/imunify360/proactive.db||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.54.114
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-37.142.111.54.114||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 05:39:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 05:39:04 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56303: 535 Incorrect authentication data (set_id=blah)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.50.50.1
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=11 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.91.250.17
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/photos/img/img/photos/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.187.112
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/photos/img/img/photos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.19.5.40
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/bag/13/97/1316311 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.78.175
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=65&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.134.81.54
country_id: 1819730
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/company/csr/environment.htm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.189
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/main.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.152
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/photos/img/img/photos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 05:52:14 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 05:52:16 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63981: 535 Incorrect authentication data (set_id=insta)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.22.235.233
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-55.82.22.235.233||RSV:7.67||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.190.140.132
country_id: 3017382
domain: kainanholding.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:185.190.140.132||TA:185.190.140.132||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.19.216.146
country_id: 6252001
description:
37.19.216.146 - - [25/Jan/2026:06:00:21 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013080&pdata=https%253A%252F%252Fwww.ds-staffing.com%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769292017 HTTP/2.0" 302 0 www.ds-staffing.com "https://www.ds-staffing.com:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.19.216.146


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.210.254
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88361515570398 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 14.235.68.30
country_id: 1562822
domain: www.usfood.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/news-and-events.php||SC:/home2/usfoodcom/public_html/img/news-and-events.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.104.207
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-02.146.103.104.207||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 06:06:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 06:06:34 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:53193: 535 Incorrect authentication data (set_id=astrid)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.28.243
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=286855 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.149.85
country_id: 690791
description:
Jan 25 06:11:17 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.149.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.84
country_id: 3469034
description:
Jan 25 06:11:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.84
country_id: 3469034
description:
Jan 25 06:11:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.162.74.9
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=44841515043556 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.165.39.127
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=69&page=7 HTTP/1.1||RSV:7.67||T:APACHE||


