# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.22
country_id: 226074
description:
Jan 23 22:35:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.72
country_id: 1733045
description:
2026-01-23 22:36:33 dovecot_login authenticator failed for H=([49.124.151.72]) [49.124.151.72]:55562: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.1.137.126
country_id: 3686110
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/career.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.214.3.253
country_id: 3175395
description:
Jan 23 22:41:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.214.3.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 99.44.102.209
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-43.99.44.102.209||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.123.39
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-43.89.110.123.39||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.75.237.216
country_id: 1733045
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/corporate.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.249.199
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/single-service.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.154.144
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/organizational.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 204.217.161.33
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-45.204.217.161.33||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.202.196
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/checkout.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.126.218.86
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/cart.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.138.86
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/about_us.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.176.192.70
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=31121515983246 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.171.53.213
country_id: 587116
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/firstaustralia.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.166.31.183
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/contect.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.17.249.195
country_id: 3437598
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/news.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.46.238.229
country_id: 6290252
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=20 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 188.34.162.28
country_id: 2921044
domain: www.kendek.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.111.5
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=940617 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.30.133
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=501726 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.193
country_id: 3469034
description:
Jan 23 22:55:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.93
country_id: 953987
description:
Jan 23 22:55:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.233
country_id: 2395170
description:
Jan 23 22:56:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.233
country_id: 2395170
description:
Jan 23 22:57:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.233 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.127.12
country_id: 1562822
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/product-posts/assets/img/product/MS Hoarding.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-23 23:03:28 H=([45.144.212.242]) [45.144.212.242]:59342 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.108.2.223
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/contact.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.176.202
country_id: 1269750
description:
Jan 23 23:07:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.176.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.210.151.64
country_id: 6252001
domain: mail.ajresorts.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.118
country_id: 6252001
description:
2026-01-23 23:07:16 611799 [Warning] Aborted connection 611799 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.118' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-23 23:09:46 H=([45.144.212.242]) [45.144.212.242]:49499 F=<no_reply@admin.com> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.106.243.90
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=212395 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.83.237
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82481516779307 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.128.172.61
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.205
country_id: 953987
description:
Jan 23 23:11:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.7
country_id: 690791
description:
Jan 23 23:11:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.41
country_id: 953987
description:
Jan 23 23:12:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.205
country_id: 953987
description:
Jan 23 23:12:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.88.8.196
country_id: 1168579
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/v2-1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350312
name: IM360 WAF: Block system file path in request
abuser: 176.65.132.140
country_id: 2921044
domain: cabe.com.my
description:
IM360 WAF: Block system file path in request||MVN:ARGS:id||MV:../../../../../../../../../etc/passwd||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.88.14
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=670535 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.113.103
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-15.108.165.113.103||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-01-23 23:16:27 dovecot_login authenticator failed for H=([169.211.232.182]) [169.211.232.182]:51408: 535 Incorrect authentication data (set_id=central)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.246.238
country_id: 1814991
description:
Jan 23 23:16:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.246.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-01-23 23:16:04 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:51298: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
country_id: 1835841
description:
Jan 23 23:16:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.172.167.245
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/nullMappingKey.yml HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/images/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.223.84.32
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=21721518076219 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.120.9
country_id: 3625428
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/product-posts/assets/img/product/MS Railing.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.221.203
country_id: 3469034
description:
Jan 23 23:24:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.221.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 94.103.88.177
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-24.94.103.88.177||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.78.29
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-24.92.71.78.29||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-23 23:25:33 +0800] info [cpaneld] 165.22.212.32 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.150.48
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=65711515044116 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.147
country_id: 3469034
description:
Jan 23 23:27:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.147
country_id: 3469034
description:
Jan 23 23:28:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.207
country_id: 3469034
description:
Jan 23 23:28:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.239.214.235
country_id: 6252001
description:
[2026-01-23 23:30:22 +0800] info [cpaneld] 173.239.214.235 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.16.95
country_id: 1562822
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/product-posts/assets/img/product/Anti Climb.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.152.227
country_id: 3469034
description:
Jan 23 23:35:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.152.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.171
country_id: 953987
description:
Jan 23 23:35:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.171
country_id: 953987
description:
Jan 23 23:36:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.33.179
country_id: 3865483
description:
Jan 23 23:36:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.33.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.14
country_id: 798544
description:
Jan 23 23:36:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.121.164.191
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.33.179
country_id: 3865483
description:
Jan 23 23:37:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.33.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.105
country_id: 732800
description:
Jan 23 23:37:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.88
country_id: 2750405
description:
2026-01-23 23:38:17 H=([185.214.10.88]) [185.214.10.88]:52270 F=<info@aircarbonic.my> rejected RCPT <info@aircarbonic.my>: smtp auth required


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.114.92.35
country_id: 1861060
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-46.50.114.92.35||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.229.106.161
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-47.138.229.106.161||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.139.129
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/images/Stadium_Negara_20240603.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.27.93.65
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-49.23.27.93.65||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.131
country_id: 3865483
description:
Jan 23 23:50:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.217
country_id: 3469034
description:
Jan 23 23:51:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.28.49
country_id: 3469034
description:
Jan 23 23:51:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.28.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.41
country_id: 719819
description:
Jan 23 23:51:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.217
country_id: 3469034
description:
Jan 23 23:52:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.217 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.171
country_id: 6252001
description:
2026-01-23 23:52:19 613405 [Warning] Aborted connection 613405 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.171' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/photos/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.126
country_id: 3469034
description:
Jan 23 23:55:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-23 23:55:37 H=([45.144.212.242]) [45.144.212.242]:54740 F=<no_reply@admin.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.245
country_id: 953987
description:
Jan 23 23:55:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.245 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.10
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/host.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-23 23:58:16 H=([45.144.212.242]) [45.144.212.242]:59086 F=<no_reply@admin.com> rejected RCPT <info@pspoly.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.154.76
country_id: 1210997
domain: tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tptec.com.my/images/logo-tppower.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.88
country_id: 2750405
description:
2026-01-23 23:59:50 H=([185.214.10.88]) [185.214.10.88]:54372 F=<info@ajplantations.com.my> rejected RCPT <estates@ajplantations.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/10anniversary.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.168.71.202
country_id: 3351879
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/product-posts/assets/img/chainlink.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.88
country_id: 2750405
description:
2026-01-24 00:00:14 H=([185.214.10.88]) [185.214.10.88]:58497 F=<info@mkmetal.com.my> rejected RCPT <info@mkmetal.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.33.142
country_id: 2589581
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=11981514510565 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.12.91
country_id: 1819730
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/img/photos/6134645157.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 00:02:41 H=([45.144.212.242]) [45.144.212.242]:63949 F=<no_reply@admin.com> rejected RCPT <info@pftfood.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.94
country_id: 2300660
description:
Jan 24 00:03:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/commercial-office.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.54
country_id: 732800
description:
Jan 24 00:05:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 00:05:10 H=([45.144.212.242]) [45.144.212.242]:49598 F=<no_reply@admin.com> rejected RCPT <support@langkawiconstructions.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.198.31.133
country_id: 2963597
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=12 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.54
country_id: 732800
description:
Jan 24 00:06:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.235
country_id: 3469034
description:
Jan 24 00:06:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.252.101.32
country_id: 298795
description:
Jan 24 00:10:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.252.101.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.19
country_id: 798544
description:
Jan 24 00:10:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 66.180.131.253
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-11.66.180.131.253||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.242.22
country_id: 1733045
description:
[2026-01-24 00:13:44 +0800] info [webmaild] 183.171.242.22 - cmchin@chs.com.my "GET /cpsess9666448205/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.247.244] != Current IP Address [183.171.242.22]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.88
country_id: 2750405
description:
2026-01-24 00:13:51 H=([185.214.10.88]) [185.214.10.88]:56956 F=<info@mkmetal.com.my> rejected RCPT <mkmadmin@mkmetal.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.198
country_id: 690791
description:
Jan 24 00:13:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.209.114
country_id: 1269750
description:
2026-01-24 00:13:14 dovecot_plain authenticator failed for H=(E7G74M1Q) [157.48.209.114]:55862: 535 Incorrect authentication data (set_id=syafiqah.ong@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.2
country_id: 1269750
description:
Jan 24 00:13:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.198
country_id: 690791
description:
Jan 24 00:14:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.43.94
country_id: 6290252
description:
Jan 24 00:14:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.43.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.162.200
country_id: 1643084
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 00:14:50 H=([45.144.212.242]) [45.144.212.242]:54239 F=<no_reply@admin.com> rejected RCPT <marylinkoh@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.194.63
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=465735 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 00:15:07 H=([45.144.212.242]) [45.144.212.242]:57019 F=<no_reply@admin.com> rejected RCPT <celine@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.129.208.161
country_id: 1210997
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Gamuda-TBM-Machine/ancillary-engineering-gamuda-tbm-02.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.182.105.168
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Gamuda-TBM-Machine/ancillary-engineering-gamuda-tbm-01.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.166.252.212
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Gamuda-TBM-Machine/ancillary-engineering-gamuda-tbm-03.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.175.253
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Gamuda-TBM-Machine/ancillary-engineering-gamuda-tbm-06.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.81.57
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Gamuda-TBM-Machine/ancillary-engineering-gamuda-tbm-05.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.227
country_id: 3175395
description:
Jan 24 00:16:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.118.114.21
country_id: 2542007
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Gamuda-TBM-Machine/ancillary-engineering-gamuda-tbm-04.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.205
country_id: 3469034
description:
Jan 24 00:18:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.183.22
country_id: 2921044
description:
2026-01-24 00:19:56 dovecot_login authenticator failed for H=(ADMIN) [87.106.183.22]:54641: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.106.183.22
country_id: 2921044
description:
Jan 24 00:19:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.106.183.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.105.48
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold Document Box-4-120x120.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.105.48
country_id: 6252001
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold Document Box-4-120x120.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-24 00:24:04 H=(localhost.localdomain) [45.150.192.143]:57198 F=<info@valencyexports.com> rejected RCPT <sales@chs.com.my>: SPF: 45.150.192.143 is not allowed to send mail from valencyexports.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.174.89.222
country_id: 3996063
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/glove-dipping-line.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.89
country_id: 2300660
description:
Jan 24 00:27:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.89
country_id: 2300660
description:
Jan 24 00:28:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.248.231
country_id: 3469034
description:
Jan 24 00:29:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.248.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.101.122
country_id: 3469034
description:
Jan 24 00:29:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.101.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 5.59.101.4
country_id: 1527747
description:
Jan 24 00:30:21 sv3 pure-ftpd[2419862]: (?@5.59.101.4) [WARNING] Authentication failed for user [admin]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.185
country_id: 798544
description:
Jan 24 00:33:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.106
country_id: 226074
description:
Jan 24 00:33:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.245.82
country_id: 3865483
description:
Jan 24 00:33:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.245.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.216
country_id: 3469034
description:
Jan 24 00:34:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.119
country_id: 3175395
description:
Jan 24 00:34:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.229
country_id: 3175395
description:
Jan 24 00:34:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.93
country_id: 953987
description:
Jan 24 00:34:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.185
country_id: 798544
description:
Jan 24 00:34:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.173.4
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=13 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.158
country_id: 1269750
description:
Jan 24 00:34:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.109.166.254
country_id: 3469034
description:
Jan 24 00:34:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.109.166.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.197.25
country_id: 3469034
description:
Jan 24 00:34:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.197.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.245.82
country_id: 3865483
description:
Jan 24 00:34:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.245.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.82.70
country_id: 1269750
description:
Jan 24 00:34:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.82.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.106
country_id: 226074
description:
Jan 24 00:34:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.97.209
country_id: 3865483
description:
Jan 24 00:34:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.97.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.82.70
country_id: 1269750
description:
Jan 24 00:35:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.82.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.158
country_id: 1269750
description:
Jan 24 00:35:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.43.82.196
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-36.45.43.82.196||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.19.45
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=680282 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.101
country_id: 1269750
description:
Jan 24 00:42:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.123.207.158
country_id: 298795
description:
[2026-01-24 00:43:49 +0800] info [whostmgrd] 94.123.207.158 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 201.218.159.213
country_id: 3932488
description:
2026-01-24 00:44:32 H=([201.218.159.213]) [201.218.159.213]:38891 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.154.236
country_id: 1269750
description:
Jan 24 00:44:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.154.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.107
country_id: 3469034
description:
Jan 24 00:44:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.43.73
country_id: 3469034
description:
Jan 24 00:45:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.43.73 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 123.56.18.251
country_id: 1814991
description:
[2026-01-24 00:45:36 +0800] info [cpaneld] 123.56.18.251 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.154.236
country_id: 1269750
description:
Jan 24 00:44:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.154.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.107
country_id: 3469034
description:
Jan 24 00:45:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.230.4
country_id: 3865483
description:
Jan 24 00:45:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.230.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.157.169
country_id: 99237
description:
Jan 24 00:45:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.157.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 201.218.159.213
country_id: 3932488
description:
2026-01-24 00:45:27 H=([201.218.159.213]) [201.218.159.213]:39372 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.230.80.44
country_id: 3865483
description:
Jan 24 00:46:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.230.80.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 201.218.159.213
country_id: 3932488
description:
2026-01-24 00:46:09 H=([201.218.159.213]) [201.218.159.213]:39543 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.230.80.44
country_id: 3865483
description:
Jan 24 00:47:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.230.80.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.232
country_id: 2510769
description:
Jan 24 00:50:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.62.76.12
country_id: 3469034
description:
Jan 24 00:50:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.62.76.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.232
country_id: 2510769
description:
Jan 24 00:51:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.92
country_id: 1269750
description:
Jan 24 00:51:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.235
country_id: 3469034
description:
Jan 24 00:51:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.141.182.20
country_id: 2542007
description:
2026-01-24 00:51:46 H=([41.141.182.20]) [41.141.182.20]:23060 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.192.197.67
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=595675 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.104.193
country_id: 1733045
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/our-products/pipe-connections/pipe-connections-m2302-large-diameter-fabricated-dismantling-joint.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.141.182.20
country_id: 2542007
description:
2026-01-24 00:52:31 H=([41.141.182.20]) [41.141.182.20]:12361 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.141.182.20
country_id: 2542007
description:
2026-01-24 00:53:12 H=([41.141.182.20]) [41.141.182.20]:12435 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.152
country_id: 3469034
description:
Jan 24 00:54:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.29
country_id: 3469034
description:
Jan 24 00:54:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 00:55:47 H=([45.144.212.242]) [45.144.212.242]:64100 F=<no_reply@admin.com> rejected RCPT <euratech@euratech.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.36.159.31
country_id: 3508796
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=66521527238804 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.30.247
country_id: 798544
description:
Jan 24 00:59:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.94.30.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/portfolio/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.5.116
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=17 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.116.132.59
country_id: 6290252
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/product-detail.php?id=782059 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.68
country_id: 953987
description:
Jan 24 01:04:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.154
country_id: 3469034
description:
Jan 24 01:05:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.68
country_id: 953987
description:
Jan 24 01:05:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 101.47.45.238
country_id: 1880251
domain: www.krisfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/webdesign.monkeymedia2u.com||User:krisfood||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.224.11.159
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/697699.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.13.17
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/801966.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.96.113.167
country_id: 2589581
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=6 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.113.89
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/217368.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.170.69.134
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/119098.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.40.26
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/549871.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.152.210.214
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/687015.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.115.244.170
country_id: 617790
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/657153.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.226.25
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/521885.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.135.169.52
country_id: 192950
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/199909.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.6.51.99
country_id: 3932488
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/707874.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.232.154.30
country_id: 1282988
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/318291.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.230.105.87
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/images/logoo-cabee.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.135.190.239
country_id: 3439705
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/844298.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.111
country_id: 3469034
description:
Jan 24 01:09:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.45
country_id: 1269750
description:
Jan 24 01:09:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.135.27.153
country_id: 1733045
description:
[2026-01-24 01:11:55 +0800] info [whostmgrd] 115.135.27.153 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.99.242
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/contact.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 98.159.226.110
country_id: 3277605
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-15.98.159.226.110||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 98.159.226.105
country_id: 3277605
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-15.98.159.226.105||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.189
country_id: 3865483
description:
Jan 24 01:16:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.189 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.112
country_id: 6252001
description:
2026-01-24  1:17:29 616969 [Warning] Aborted connection 616969 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.112' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.228.227
country_id: 6252001
description:
Jan 24 01:18:37 sv3 pure-ftpd[2449251]: (?@172.236.228.227) [INFO] New connection from 172.236.228.227


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.99.217.254
country_id: 102358
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/enquiry.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.89.80.151
country_id: 6252001
description:
2026-01-24 01:19:51 dovecot_login authenticator failed for H=([127.0.0.1]) [99.89.80.151]:10817: 535 Incorrect authentication data (set_id=info@imax.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.76.181
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=285490 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.53.121
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/service.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.238
country_id: 3175395
description:
Jan 24 01:21:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.120.113
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=349522 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.152.82.170
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=756141 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.44
country_id: 3469034
description:
Jan 24 01:21:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.203
country_id: 3175395
description:
Jan 24 01:21:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.24.34.253
country_id: 6290252
description:
Jan 24 01:21:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.24.34.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 90.156.166.215
country_id: 1512440
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=235857 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/home/csr.php||SC:/home/indfinitydesign/public_html/images/home||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.171.243.54
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=671968 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.188.54.127
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=34 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.237.116.35
country_id: 3686110
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=791633 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.141.147
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/about.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.48.154.227
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/resize.php?h=360&img=img/category_photos/59477378.jpg&w=360 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.39.45.23
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=1 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.233.111.213
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=171212 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.255.181.82
country_id: 6251999
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/product/moving-box-large-heavy-duty-55x40x45cm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Jan 24 01:24:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.193.243.162
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=642809 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-24 01:24:33 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:38240: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.88
country_id: 3175395
description:
Jan 24 01:24:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.224.67.97
country_id: 3895114
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=603392 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.166.59
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=936837 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.106.138
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=39911516782530 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 13.233.140.182
country_id: 1269750
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/news-detail-7.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.243.1.118
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&page_id=3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.56.184.178
country_id: 6252001
domain: feliogroup.com.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.67||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.253.53.68
country_id: 1643084
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=689366 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.74.239
country_id: 163843
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7018710133.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.123.19
country_id: 3865483
description:
Jan 24 01:33:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.169
country_id: 6252001
description:
Jan 24 01:33:26 sv3 pure-ftpd[2460214]: (?@198.235.24.169) [INFO] New connection from 198.235.24.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.17
country_id: 953987
description:
Jan 24 01:37:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.146.49
country_id: 6252001
description:
[2026-01-24 01:38:21 +0800] info [whostmgrd] 74.244.146.49 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.10
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/nfs.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.192.45.67
country_id: 1168579
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.12.204.108
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/LocaleListener.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 01:55:38 H=([45.144.212.242]) [45.144.212.242]:50976 F=<lynnied@mhtc.net> rejected RCPT <asttwu@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.10.5.64
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=685978 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 223.181.22.195
country_id: 1269750
domain: visoft.com.my
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:7.67||T:APACHE||MVN:ARGS:spec.ioConfig.consumerProperties.sasl.login.callback.handler.class||MV:org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler||


plugin: modsec
rule: 77625156
name: IM360 WAF: Generic file inclusion block
abuser: 223.181.22.195
country_id: 1269750
domain: visoft.com.my
description:
IM360 WAF: Generic file inclusion block||RSV:7.67||T:APACHE||MVN:ARGS:spec.ioConfig.consumerProperties.sasl.oauthbearer.token.endpoint.url||MV:file:///etc/passwd||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 223.181.22.195
country_id: 1269750
domain: visoft.com.my
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:file:///etc/passwd||MVN:MATCHED_VAR||WPU:||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.129.212.87
country_id: 3469034
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/company.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.39.50
country_id: 3469034
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/base/img/layout/logos/logo-3.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.147.47
country_id: 1562822
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: cl_dos
name: DOS detection
abuser: 152.53.52.160
country_id: 6252001
description:
2026-01-24 02:02:37.723635187 +0800 +08 m=+613245.957075573 Denial of Service attack was discovered from 152.53.52.160, on port 443. Open connections: 484


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.102.246.39
country_id: 3865483
domain: mail.uumism.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.uumism.edu.my/cgi-bin/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.139.240
country_id: 719819
description:
Jan 24 02:04:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.139.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.54.158.74
country_id: 99237
domain: mail.uumism.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.uumism.edu.my/cgi-bin HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.244.218
country_id: 1814991
description:
Jan 24 02:05:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.244.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.67.170.155
country_id: 3932488
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=527241 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.139.240
country_id: 719819
description:
Jan 24 02:05:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.139.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.191
country_id: 3175395
description:
Jan 24 02:05:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jan 24 02:07:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.242.245.25
country_id: 1269750
description:
Jan 24 02:07:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.242.245.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.193
country_id: 3469034
description:
Jan 24 02:07:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/keyword/img/photos/csr.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
country_id: 1814991
description:
Jan 24 02:08:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-01-24 02:08:56 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:47467: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.242.234.142
country_id: 798544
description:
Jan 24 02:08:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.242.234.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.129.193
country_id: 3469034
description:
Jan 24 02:08:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.129.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.242.234.142
country_id: 798544
description:
Jan 24 02:09:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.242.234.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.152.225
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=26031515746171 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
country_id: 290557
description:
Jan 24 02:14:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-24 02:14:19 dovecot_login authenticator failed for H=([80.227.102.242]) [80.227.102.242]:56026: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.222.88
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event-single.php?id=177905 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.32
country_id: 3469034
description:
Jan 24 02:17:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.32
country_id: 3469034
description:
Jan 24 02:18:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.243
country_id: 3469034
description:
Jan 24 02:18:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.210.57
country_id: 798544
description:
Jan 24 02:18:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.210.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.210.57
country_id: 798544
description:
Jan 24 02:19:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.210.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.133.98
country_id: 1814991
description:
Jan 24 02:19:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.133.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.133.98
country_id: 1814991
description:
2026-01-24 02:19:24 dovecot_login authenticator failed for H=([221.224.133.98]) [221.224.133.98]:44748: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.246.223.169
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=41811526629395 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.47.208.227
country_id: 3469034
description:
Jan 24 02:22:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.47.208.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.222
country_id: 3469034
description:
Jan 24 02:23:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.222 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 02:25:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.3
country_id: 2750405
description:
2026-01-24 02:26:45 H=([46.151.182.3]) [46.151.182.3]:62138 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 02:27:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 02:29:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-24 02:29:45 H=(localhost.localdomain) [45.150.192.143]:49760 F=<info@valencyexports.com> rejected RCPT <info@pspoly.com.my>: SPF: 45.150.192.143 is not allowed to send mail from valencyexports.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.60.191.126
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Mail HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.206.88.22
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Mail/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.187.167.72
country_id: 1269750
description:
Jan 24 02:30:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.187.167.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.85.84
country_id: 6252001
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/about/about-chs-steelworks2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.139.33.243
country_id: 1814991
description:
Jan 24 02:32:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.139.33.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.121
country_id: 2963597
description:
Jan 24 02:36:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.48
country_id: 798544
description:
Jan 24 02:36:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.22
country_id: 2395170
description:
Jan 24 02:37:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.139.33.243
country_id: 1814991
description:
Jan 24 02:38:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.139.33.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.235.152.130
country_id: 1814991
description:
Jan 24 02:38:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.235.152.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.216.218.241
country_id: 2378080
description:
2026-01-24 02:40:11 H=([102.216.218.241]) [102.216.218.241]:9550 F=<JohnBlue@hola.com> rejected RCPT <yuankhai.chong@tujusetia.my>: No such person at this address."


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.33.153
country_id: 3865483
description:
Jan 24 02:42:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.33.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.33.153
country_id: 3865483
description:
Jan 24 02:43:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.33.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.193
country_id: 953987
description:
Jan 24 02:43:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.7
country_id: 690791
description:
2026-01-24 02:44:31 H=([45.144.212.7]) [45.144.212.7]:64040 F=<ops.indel@saglogistics.in> rejected RCPT <myloo@euratech.com.my>: Mail to myloo@euratech.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.193
country_id: 953987
description:
Jan 24 02:43:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.17.108.185
country_id: 6290252
description:
Jan 24 02:44:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.17.108.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.206.254.122
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&page_id=1&sub=41 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.95.138
country_id: 1861060
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/our-products/pipeworks/M-1101-11_AD_MSCL_Pipe.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.206.65.40
country_id: 1269750
description:
Jan 24 02:46:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 15.206.65.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.133
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-51.198.145.50.133||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-24 02:51:15 H=([45.144.212.41]) [45.144.212.41]:52009 F=<powerbiz@emirates.net.ae> rejected RCPT <cklee@ktlog.com.my>: SPF: 45.144.212.41 is not allowed to send mail from emirates.net.ae


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.173
country_id: 3865483
description:
Jan 24 02:51:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.173
country_id: 3865483
description:
Jan 24 02:52:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.14.61.156
country_id: 298795
description:
Jan 24 02:52:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.14.61.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.34.120.78
country_id: 2750405
description:
2026-01-24 02:54:31 dovecot_login authenticator failed for H=78.120.34.34.bc.googleusercontent.com (10.164.0.2) [34.34.120.78]:63113: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 82.165.213.127
country_id: 6252001
domain: oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/flyriver.com||User:oxboldc||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.24.219.218
country_id: 102358
description:
Jan 24 02:57:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.24.219.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-24 02:57:45 H=([31.145.189.54]) [31.145.189.54]:53390 F=<dse_NA2@docusign.net> rejected RCPT <info@astlog.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.24.219.218
country_id: 102358
description:
Jan 24 02:58:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.24.219.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.123.39
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-57.89.110.123.39||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.52.237
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=84 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.126.106.125
country_id: 1269750
description:
Jan 24 03:00:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.126.106.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 03:01:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.76.199
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=67771514942297 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-24 03:02:45 H=([31.145.189.54]) [31.145.189.54]:52168 F=<dse_NA2@docusign.net> rejected RCPT <info@ktlog.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 03:04:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.185.212
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=11541516782188 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-24 03:04:42 H=(localhost.localdomain) [45.150.192.143]:51346 F=<info@valencyexports.com> rejected RCPT <info@mkmetal.com.my>: SPF: 45.150.192.143 is not allowed to send mail from valencyexports.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.169.229
country_id: 149590
description:
Jan 24 03:06:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.78.169.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.196
country_id: 953987
description:
Jan 24 03:06:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 03:07:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.135.99
country_id: 690791
description:
Jan 24 03:07:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.135.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.70
country_id: 732800
description:
Jan 24 03:07:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.70
country_id: 732800
description:
Jan 24 03:07:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.2.145.5
country_id: 298795
description:
2026-01-24 03:09:55 H=([46.2.145.5]) [46.2.145.5]:29751 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.184.249.198
country_id: 290291
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=318025 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.43.111
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-10.171.236.43.111||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.2.145.5
country_id: 298795
description:
2026-01-24 03:10:37 H=([46.2.145.5]) [46.2.145.5]:30200 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 03:10:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.2.145.5
country_id: 298795
description:
2026-01-24 03:11:19 H=([46.2.145.5]) [46.2.145.5]:30346 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.2.145.5
country_id: 298795
description:
2026-01-24 03:12:01 H=([46.2.145.5]) [46.2.145.5]:30406 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/products.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.124.241
country_id: 798544
description:
Jan 24 03:13:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.124.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.125
country_id: 2300660
description:
Jan 24 03:13:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.206
country_id: 226074
description:
Jan 24 03:13:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.21
country_id: 3469034
description:
Jan 24 03:13:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.245.74.138
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-14.72.245.74.138||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
country_id: 1814991
description:
Jan 24 03:14:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-01-24 03:14:36 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:55760: 535 Incorrect authentication data (set_id=2096jasonkua@printspecsolution.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-24 03:15:22 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:50378: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/interior.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-01-24 03:16:44 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (scentang) [73.199.161.144]:51416: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-24 03:16:49 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (arize) [87.103.126.54]:28504: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.161.144
country_id: 6252001
description:
Jan 24 03:16:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.161.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 24 03:16:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 35.209.103.28
country_id: 6252001
domain: inter-link.edu.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/100.0.4896.127 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 24 03:20:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-24 03:20:11 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (recred) [87.103.126.54]:38737: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-24 03:20:29 H=([31.145.189.54]) [31.145.189.54]:54445 F=<dse_NA2@docusign.net> rejected RCPT <info@pspoly.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.227.106.26
country_id: 1668284
description:
[2026-01-24 03:21:26 +0800] info [whostmgrd] 36.227.106.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.157.109.60
country_id: 453733
description:
Jan 24 03:21:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.157.109.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.73.43
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-22.142.111.73.43||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 24 03:23:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-24 03:23:10 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (oburded) [87.103.126.54]:26537: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.186.10
country_id: 1562822
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/pipeworks.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 03:24:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Jan 24 03:24:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2026-01-24 03:24:46 dovecot_login authenticator failed for H=([121.128.76.109]) [61.72.59.106]:53068: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 03:25:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 24 03:25:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-24 03:25:10 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:47834: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.132.190
country_id: 3175395
description:
Jan 24 03:26:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.132.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 24 03:27:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-24 03:27:11 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (perquis) [87.103.126.54]:61825: 535 Incorrect authentication data (set_id=vsloh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.49
country_id: 298795
description:
Jan 24 03:28:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.41.90
country_id: 3469034
description:
Jan 24 03:29:23 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.132
country_id: 3175395
description:
Jan 24 03:29:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.132
country_id: 3175395
description:
Jan 24 03:30:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.217.104.215
country_id: 2077456
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/about/about-chs-steelworks1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.205
country_id: 1269750
description:
Jan 24 03:31:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.124.41
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=48031516685613 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.246
country_id: 3469034
description:
Jan 24 03:37:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.75.132
country_id: 3469034
description:
Jan 24 03:38:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.75.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.246
country_id: 3469034
description:
Jan 24 03:38:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.206.65.40
country_id: 1269750
description:
Jan 24 03:39:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 15.206.65.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77140852
name: IM360 WAF: SQL Dorks collection for SQL Injection
abuser: 65.111.30.228
country_id: 3017382
domain: www.nobledec.com
description:
IM360 WAF: SQL Dorks collection for SQL Injection||MVN:ARGS:id||RSV:7.67||T:APACHE||MV:<script>alert('XSS')</script>||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.228.249.193
country_id: 3996063
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/products_ABS.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350312
name: IM360 WAF: Block system file path in request
abuser: 104.207.45.151
country_id: 6252001
domain: www.nobledec.com
description:
IM360 WAF: Block system file path in request||MVN:ARGS:sub||MV:../../../../../../../../../etc/passwd||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.123.39
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-46.89.110.123.39||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.131.139
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=816746 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.187.74
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=836901 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.206.65.40
country_id: 1269750
description:
Jan 24 04:02:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 15.206.65.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.245.141
country_id: 3865483
description:
Jan 24 04:04:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.245.141 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.24.115
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=35041515979746 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.87.132
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=27 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.36.133
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.78.78
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-11.92.71.78.78||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.97
country_id: 3996063
description:
Jan 24 04:11:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.97
country_id: 3996063
description:
Jan 24 04:11:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.180
country_id: 798544
description:
Jan 24 04:12:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.11
country_id: 2300660
description:
Jan 24 04:12:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.11 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.241.150.246
country_id: 2017370
description:
Jan 24 04:13:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.241.150.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-01-24 04:13:50 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:40842: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.203.67.115
country_id: 1269750
description:
Jan 24 04:14:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.203.67.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.126.106.125
country_id: 1269750
description:
Jan 24 04:13:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.126.106.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.136.35.176
country_id: 6252001
description:
Jan 24 04:14:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.136.35.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.79.83.98
country_id: 1269750
description:
Jan 24 04:14:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.79.83.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-24 04:15:01 dovecot_login authenticator failed for H=([182.79.83.98]) [182.79.83.98]:36766: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.195.17
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/2259631427.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.40.101.10
country_id: 6252001
description:
Jan 24 04:16:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.40.101.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-24 04:16:38 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (ariestiver) [98.40.101.10]:33478: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.206.65.40
country_id: 1269750
description:
Jan 24 04:16:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 15.206.65.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 70.31.63.210
country_id: 6251999
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cold/15/659/1522032 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.55.123.173
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32251514966674 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.126.106.125
country_id: 1269750
description:
Jan 24 04:19:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.126.106.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-24 04:20:48 H=([45.144.212.41]) [45.144.212.41]:60869 F=<powerbiz@emirates.net.ae> rejected RCPT <shipping@cordage.com.my>: SPF: 45.144.212.41 is not allowed to send mail from emirates.net.ae


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.183.247.8
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=55981516587040 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.158.113.88
country_id: 1814991
description:
Jan 24 04:21:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.158.113.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.206.65.40
country_id: 1269750
description:
Jan 24 04:26:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 15.206.65.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.33.170
country_id: 3865483
description:
Jan 24 04:28:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.33.170 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.29.76.89
country_id: 294640
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/9421503242.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.163.188
country_id: 1562822
description:
Jan 24 04:30:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.163.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.109.99.59
country_id: 660013
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-30.65.109.99.59||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.211.244
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&page_id=1&sub=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 04:31:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.158.113.88
country_id: 1814991
description:
Jan 24 04:32:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.158.113.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.57.53
country_id: 1269750
description:
Jan 24 04:33:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.57.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.154.229
country_id: 192950
description:
2026-01-24 04:34:30 dovecot_plain authenticator failed for H=(3kxa4xj859nicafr0i6b55ush4nvhj) [196.207.154.229]:63972: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.190.99
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=2&sub=6 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.136.35.176
country_id: 6252001
description:
Jan 24 04:36:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.136.35.176 has been locked due to Imunify RBL


plugin: cl_dos
name: DOS detection
abuser: 152.53.52.160
country_id: 6252001
description:
2026-01-24 04:36:46.886272798 +0800 +08 m=+622495.119713210 Denial of Service attack was discovered from 152.53.52.160, on port 443. Open connections: 477


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.116
country_id: 6252001
description:
Jan 24 04:37:12 sv3 pure-ftpd[2587792]: (?@198.235.24.116) [INFO] New connection from 198.235.24.116


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.46
country_id: 3469034
description:
Jan 24 04:37:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.158.113.88
country_id: 1814991
description:
Jan 24 04:38:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.158.113.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.46
country_id: 3469034
description:
Jan 24 04:37:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.215.220.108
country_id: 798544
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/run/dovecot/dovecot.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.34.239
country_id: 6290252
description:
Jan 24 04:38:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.34.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.158.113.88
country_id: 1814991
description:
Jan 24 04:39:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.158.113.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.111.31
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=35751514512788 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.85
country_id: 953987
description:
Jan 24 04:41:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.198.1.89
country_id: 798544
description:
Jan 24 04:41:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.198.1.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.70
country_id: 933860
description:
Jan 24 04:41:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.223
country_id: 3469034
description:
Jan 24 04:41:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.233
country_id: 3175395
description:
Jan 24 04:44:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.105.141.233
country_id: 798544
description:
Jan 24 04:45:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.105.141.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.233
country_id: 3175395
description:
Jan 24 04:44:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.233 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.231.0.190
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=558493 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.142
country_id: 3469034
description:
Jan 24 04:46:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 04:47:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 04:47:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.212.19.14
country_id: 2510769
description:
Jan 24 04:48:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.212.19.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.126.106.125
country_id: 1269750
description:
Jan 24 04:48:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.126.106.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.212.19.14
country_id: 2510769
description:
Jan 24 04:49:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.212.19.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.41.43.193
country_id: 3277605
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/1900553621.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.138
country_id: 2963597
description:
Jan 24 04:49:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.72
country_id: 798544
description:
Jan 24 04:50:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.96.115.52
country_id: 192950
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/mockery/index.rst HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 04:51:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.4
country_id: 798544
description:
Jan 24 04:51:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.249
country_id: 690791
description:
Jan 24 04:51:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.105.219.200
country_id: 690791
description:
Jan 24 04:53:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.105.219.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.190
country_id: 953987
description:
Jan 24 04:53:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 04:53:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.45
country_id: 3865483
description:
Jan 24 04:54:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.45 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.51.89.191
country_id: 1282988
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=50411523515332 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.158.113.88
country_id: 1814991
description:
Jan 24 04:59:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.158.113.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-24 04:59:22 H=(localhost.localdomain) [45.150.192.143]:34700 F=<info@valencyexports.com> rejected RCPT <jacklim@ktlog.com.my>: SPF: 45.150.192.143 is not allowed to send mail from valencyexports.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.136.35.176
country_id: 6252001
description:
Jan 24 05:02:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.136.35.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.43
country_id: 953987
description:
Jan 24 05:06:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.155
country_id: 3175395
description:
Jan 24 05:06:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.126.106.125
country_id: 1269750
description:
Jan 24 05:07:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 13.126.106.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.52.116
country_id: 1814991
description:
Jan 24 05:08:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.52.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.55.83.122
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78271514858017 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.49.51.17
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=73481515394150 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.213.245.210
country_id: 1269750
description:
Jan 24 05:09:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.213.245.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.227.70
country_id: 1269750
description:
Jan 24 05:10:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.227.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.94.122
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=740138 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.136.35.176
country_id: 6252001
description:
Jan 24 05:12:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.136.35.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.135.241.176
country_id: 6252001
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/our-services/icon-our-services-maintenance-and-repair_blue.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.61
country_id: 6252001
description:
2026-01-24  5:13:22 625368 [Warning] Aborted connection 625368 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.61' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.7
country_id: 690791
description:
Jan 24 05:14:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.89.199.73
country_id: 2542007
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/VerificationExpectation.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.81.170.69
country_id: 4566966
description:
Jan 24 05:15:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.81.170.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.150
country_id: 3469034
description:
Jan 24 05:15:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.150
country_id: 3469034
description:
Jan 24 05:15:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.75.78.205
country_id: 798544
description:
Jan 24 05:18:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.75.78.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jan 24 05:18:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.30
country_id: 3175395
description:
Jan 24 05:18:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.104.225.201
country_id: 6252001
description:
Jan 24 05:19:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.104.225.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.83.78
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=71031514510608 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 60.243.124.133
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=71741516782353 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 05:24:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.49
country_id: 2264397
domain: smartcable.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.136.35.176
country_id: 6252001
description:
Jan 24 05:26:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.136.35.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.241.195
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-29.166.0.241.195||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.95
country_id: 690791
description:
Jan 24 05:29:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.147
country_id: 798544
description:
Jan 24 05:30:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.206
country_id: 2300660
description:
Jan 24 05:30:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 05:30:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.95
country_id: 690791
description:
Jan 24 05:30:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.12
country_id: 2395170
description:
Jan 24 05:30:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.205.152
country_id: 3469034
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/product-details.php?id=526297 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.175.114.71
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=29461514528384 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.198.155
country_id: 2413451
description:
Jan 24 05:34:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.198.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.98
country_id: 3469034
description:
Jan 24 05:34:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.168
country_id: 1269750
description:
Jan 24 05:34:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.224.67.58
country_id: 3895114
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/HashTable.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.198.155
country_id: 2413451
description:
Jan 24 05:35:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.198.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.98
country_id: 3469034
description:
Jan 24 05:35:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.3.137
country_id: 953987
description:
Jan 24 05:35:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.3.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.198.155
country_id: 2413451
description:
Jan 24 05:36:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.198.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.226.132.56
country_id: 953987
description:
Jan 24 05:37:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.226.132.56 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.172.161.57
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravelcollective/html/src/HtmlFacade.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.223
country_id: 3469034
description:
Jan 24 05:38:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.12
country_id: 3175395
description:
Jan 24 05:40:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.43.61
country_id: 3469034
description:
Jan 24 05:40:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.43.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.43.61
country_id: 3469034
description:
Jan 24 05:41:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.43.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.25.251.236
country_id: 1210997
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/8933024424.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.191.39
country_id: 3469034
description:
Jan 24 05:47:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.191.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.210
country_id: 1269750
description:
Jan 24 05:47:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.210
country_id: 1269750
description:
Jan 24 05:47:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.153.83
country_id: 99237
description:
[2026-01-24 05:49:56 +0800] info [cpaneld] 185.244.153.83 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.106.119.55
country_id: 1210997
description:
[2026-01-24 05:49:58 +0800] info [cpaneld] 103.106.119.55 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.63.34.233
country_id: 3686110
description:
[2026-01-24 05:50:02 +0800] info [whostmgrd] 181.63.34.233 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 36.50.149.240
country_id: 1282988
description:
[2026-01-24 05:50:08 +0800] info [cpaneld] 36.50.149.240 - urb "GET /login/?login_only=1&user=urb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user urb (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.29
country_id: 3469034
description:
Jan 24 05:51:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.92.203.127
country_id: 2782113
description:
Jan 24 05:51:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.92.203.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.235
country_id: 3469034
description:
Jan 24 05:52:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.117.93.53
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=553044 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.95
country_id: 690791
description:
Jan 24 05:52:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.136.35.176
country_id: 6252001
description:
Jan 24 05:52:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.136.35.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.48
country_id: 933860
description:
Jan 24 05:52:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.48
country_id: 933860
description:
Jan 24 05:53:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.48 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.199
country_id: 6252001
description:
2026-01-24  5:55:19 626583 [Warning] Aborted connection 626583 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.199' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.180.110.35
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-58.216.180.110.35||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.129
country_id: 298795
description:
Jan 24 05:59:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.255.86
country_id: 3469034
description:
Jan 24 06:00:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.255.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.194.240
country_id: 798544
description:
Jan 24 06:00:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.194.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.39
country_id: 3175395
description:
Jan 24 06:00:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.27
country_id: 798544
description:
Jan 24 06:00:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.39
country_id: 3175395
description:
Jan 24 06:00:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.27
country_id: 798544
description:
Jan 24 06:01:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 122.8.91.165
country_id: 1819730
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-04.122.8.91.165||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.22
country_id: 2750405
description:
Jan 24 06:04:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.180
country_id: 3469034
description:
Jan 24 06:06:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.191
country_id: 732800
description:
Jan 24 06:06:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.191 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.19.216.146
country_id: 6252001
description:
37.19.216.146 - - [24/Jan/2026:06:06:47 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13146012&pdata=http%253A%252F%252F99c56713-85d2-426a-9008-5ab45db1485c.krisfood.com%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769206005 HTTP/1.1" 302 0 99c56713-85d2-426a-9008-5ab45db1485c.krisfood.com "http://99c56713-85d2-426a-9008-5ab45db1485c.krisfood.com:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.19.216.146


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 198.74.59.247
country_id: 6252001
description:
Jan 24 06:07:13 sv3 pure-ftpd[2641694]: (?@198.74.59.247) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.12
country_id: 2750405
description:
Jan 24 06:08:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.20
country_id: 2750405
description:
Jan 24 06:08:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.16
country_id: 2750405
description:
Jan 24 06:08:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 06:10:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.248.82
country_id: 1733045
description:
[2026-01-24 06:12:31 +0800] info [webmaild] 27.125.248.82 - chuacp@ms-chemicals.net "GET /cpsess3456854464/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.13
country_id: 2750405
description:
Jan 24 06:12:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.21
country_id: 2750405
description:
Jan 24 06:13:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.17
country_id: 2750405
description:
Jan 24 06:13:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.152.18.77
country_id: 1814991
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.14
country_id: 3469034
description:
Jan 24 06:15:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.7
country_id: 690791
description:
Jan 24 06:15:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.211
country_id: 3469034
description:
Jan 24 06:16:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.7
country_id: 690791
description:
Jan 24 06:16:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.253
country_id: 690791
description:
Jan 24 06:16:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.2.104.160
country_id: 3895114
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=76661516696123 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.123
country_id: 3469034
description:
Jan 24 06:16:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.123
country_id: 3469034
description:
Jan 24 06:17:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 06:17:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.78.63
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-18.92.71.78.63||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 06:18:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 24 06:20:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 06:22:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.136.35.176
country_id: 6252001
description:
Jan 24 06:22:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.136.35.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 06:24:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.191.160
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1347760560.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.153.178.10
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/9624219134.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.182.220.32
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7304367765.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.251.33.107
country_id: 3686110
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/4448233375.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.86.192.57
country_id: 1210997
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1948884370.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.29.125.9
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7836306985.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.10.10.178
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/4383400041.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.50.212.179
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1000757560.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.102.208
country_id: 3625428
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/2541180154.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.148.246.199
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1191009474.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.143.117
country_id: 99237
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/product/image-1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.144.80.225
country_id: 1831722
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6551578920.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.140.112.71
country_id: 3703430
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8021556551.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.134.221.218
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1610914845.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.107.52.148
country_id: 2589581
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1438588799.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.147.8
country_id: 3625428
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1160288990.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.157.236.241
country_id: 1168579
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6656708877.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.152.25.139
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7854020386.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.53.179.49
country_id: 3439705
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3081359389.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.15.249.159
country_id: 953987
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1642748575.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.174.134.252
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3364730032.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.147.159.175
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1475280832.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.106.129
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3261222064.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.225.231
country_id: 337996
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7050997307.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.253.5
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1432963176.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.97.217.239
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7018710133.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.189.92.224
country_id: 3895114
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5833569366.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.0.141
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8066754488.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.140.106
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/9784566891.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.155.116
country_id: 248816
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8280649870.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.149.232.123
country_id: 1210997
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.62.43
country_id: 99237
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3478499250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.96.59.233
country_id: 2542007
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/9308619345.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.200.37.214
country_id: 1210997
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/2208830992.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.136.208
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/2592143123.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.164.160.76
country_id: 2542007
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/2956267565.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.7.180.39
country_id: 3932488
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3478025547.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.18.73.102
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6929797045.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.115.255.159
country_id: 1210997
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5443638402.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.141.245.173
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/d-slide/cover-test-3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.131.26.202
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/d-slide/cover-test-1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.231.6
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8620014437.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.140.12.255
country_id: 2542007
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/4698581666.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.178.38.155
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7087369751.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.201.248.113
country_id: 99237
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5660716866.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.140.44.59
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/2391117844.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.132.137.191
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3210330036.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.160.17
country_id: 1210997
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5689504881.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.215.92.186
country_id: 290557
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5857379306.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.219.167.76
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8906778389.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.122.57.133
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1096457252.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.188.15
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/4154894080.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.49.1.198
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1038782961.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.220.153.27
country_id: 2589581
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/9099597093.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.248.176.185
country_id: 3625428
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3249053632.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.120.60
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/4160942458.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.40.185.244
country_id: 3895114
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5866097193.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.0.57.158
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1815893038.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.68.172
country_id: 2589581
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7984216425.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.231.103.213
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7420219254.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.81.54.66
country_id: 272103
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6808306640.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.163.12.187
country_id: 690791
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5877237065.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.66.194
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8769952742.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.70.175.251
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/9643310214.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.102.39.9
country_id: 3624060
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/2720545393.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.45.129.250
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3902340704.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.123.52.108
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1837678371.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.224.206.255
country_id: 163843
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/2460079596.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.227.69.146
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6143772395.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.203.45.184
country_id: 1168579
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1850291455.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.229.144
country_id: 3437598
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5420821273.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.161.133.80
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3822374154.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.178.181.18
country_id: 2464461
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7156664533.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.15.93.229
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3182267374.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.30.37
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/logo.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.15.218.162
country_id: 2464461
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/4173482170.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.178.129
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/4919911682.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.121.214.209
country_id: 3625428
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1968065316.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.6.73
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5198741923.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.182.160.134
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/2909723992.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.228.139
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/4882747803.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.223.172.84
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6570274315.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.184.151.44
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/2906070346.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.14.33.2
country_id: 3625428
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3630216953.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.103.66.18
country_id: 2589581
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1794014125.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.80.125.203
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/1981763626.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.225.202.134
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5769668535.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.225.189.69
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8931743669.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.232.107.153
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/4644883523.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.163.154.171
country_id: 630336
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7432733418.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.103.119.216
country_id: 1282988
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7780725114.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.248.158.78
country_id: 3625428
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7197110174.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.119.248.131
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/4483998210.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.13.194.55
country_id: 953987
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3196769273.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.103.249.241
country_id: 174982
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8513259455.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.194.68
country_id: 1210997
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6373026814.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.53.188.105
country_id: 3686110
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7279303519.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.230.55.231
country_id: 3996063
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8993827919.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 121.121.185.130
country_id: 1733045
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/3875603723.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.46.198.16
country_id: 1168579
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6452032098.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.50.232.121
country_id: 3658394
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8770878351.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.170.67
country_id: 248816
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/8384547533.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.68.118.28
country_id: 1210997
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/d-slide/cover-test-6.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.52.34.111
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/6190367538.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.89.155
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/4809670000.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.139.89
country_id: 1562822
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/2896274860.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.130.28.58
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/5782936036.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.229.204
country_id: 3469034
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7577380064.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.209.14.79
country_id: 192950
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/img/photos/7305723605.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.158.10
country_id: 99237
description:
Jan 24 06:26:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.158.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-01-24 06:26:40 dovecot_login authenticator failed for H=([65.20.158.10]) [65.20.158.10]:43652: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.25
country_id: 2750405
description:
Jan 24 06:29:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.138.16.219
country_id: 798544
description:
2026-01-24 06:30:43 dovecot_plain authenticator failed for H=([45.138.16.219]) [45.138.16.219]:54869: 535 Incorrect authentication data (set_id=safuan@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.199.29.34
country_id: 3686110
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=15 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 102.217.242.123
country_id: 953987
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/61-urw-d050000l.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.228.11.246
country_id: 294640
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/?lang=en HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-24 06:35:44 H=([77.83.39.188]) [77.83.39.188]:27886 F=<kasim_kn@ajplantations.com.my> rejected RCPT <kasim_kn@ajplantations.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.7.187.192
country_id: 3469034
description:
Jan 24 06:36:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.7.187.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.7
country_id: 798544
description:
Jan 24 06:36:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.217
country_id: 3469034
description:
Jan 24 06:36:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.122
country_id: 2963597
description:
Jan 24 06:36:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.46
country_id: 3865483
description:
Jan 24 06:36:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.179.91
country_id: 3175395
description:
Jan 24 06:36:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.179.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.49.122
country_id: 2963597
description:
Jan 24 06:37:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.49.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.217
country_id: 3469034
description:
Jan 24 06:37:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.46
country_id: 3865483
description:
Jan 24 06:37:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.101.250
country_id: 226074
description:
Jan 24 06:37:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.101.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.94
country_id: 3175395
description:
Jan 24 06:37:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.169
country_id: 3469034
description:
Jan 24 06:42:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.169 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.231
country_id: 2300660
description:
Jan 24 06:43:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 06:43:20 H=([45.144.212.242]) [45.144.212.242]:63433 F=<lynnied@mhtc.net> rejected RCPT <marina@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.238
country_id: 2300660
description:
Jan 24 06:43:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.238
country_id: 2300660
description:
Jan 24 06:43:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.187
country_id: 798544
description:
Jan 24 06:45:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 06:45:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-24 06:46:14 H=([77.83.39.188]) [77.83.39.188]:58755 F=<munch@nexuscollection.com> rejected RCPT <munch@nexuscollection.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.118
country_id: 3469034
description:
Jan 24 06:46:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.233
country_id: 2300660
description:
Jan 24 06:47:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.118
country_id: 3469034
description:
Jan 24 06:47:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-47.77.238.251.212||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 06:48:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.35
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/product.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.35.14
country_id: 3469034
description:
Jan 24 06:50:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.35.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.44.171
country_id: 1269750
description:
Jan 24 06:50:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.44.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.161
country_id: 3175395
description:
Jan 24 06:50:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.207.199
country_id: 99237
description:
Jan 24 06:50:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.207.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.226.156
country_id: 3057568
description:
Jan 24 06:51:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.226.156 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.0.34
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/services.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.102.56
country_id: 1562822
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/product-details.php?id=849830 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.170.192
country_id: 6252001
description:
[2026-01-24 06:52:15 +0800] info [webmaild] 191.102.170.192 - achigold@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.159.122
country_id: 6252001
description:
[2026-01-24 06:52:17 +0800] info [webmaild] 191.102.159.122 - ajplantations@ajplantations.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.61
country_id: 6252001
domain: hmz.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/92.0.4515.107 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.140.111
country_id: 732800
description:
Jan 24 06:55:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.140.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-24 06:57:44 H=([77.83.39.188]) [77.83.39.188]:36775 F=<sales@cordage.com.my> rejected RCPT <sales@cordage.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.239.37
country_id: 1562822
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/contactus.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/home/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.19.119.252
country_id: 798544
description:
Jan 24 06:58:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.19.119.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 06:59:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.19.119.252
country_id: 798544
description:
Jan 24 06:58:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.19.119.252 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.137.166.241
country_id: 6252001
description:
[2026-01-24 07:03:46 +0800] info [webmaild] 143.137.166.241 - garylee@autogreastar.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.15.247.26
country_id: 2510769
description:
[2026-01-24 07:03:48 +0800] info [webmaild] 45.15.247.26 - autogreastar@autogreastar.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 07:04:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-01-24 07:04:24 H=([77.83.39.188]) [77.83.39.188]:4506 F=<stevenng@fkr.com.my> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.70.236.196
country_id: 3658394
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/vcr.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.46
country_id: 3469034
description:
Jan 24 07:07:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 07:07:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.146.83
country_id: 690791
description:
Jan 24 07:07:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.146.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.196.87
country_id: 798544
description:
Jan 24 07:08:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.196.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.170.99
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.49
country_id: 3469034
description:
Jan 24 07:08:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 07:10:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.74.47.71
country_id: 3017382
description:
Jan 24 07:12:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.74.47.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/iso.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.130
country_id: 1269750
description:
2026-01-24 07:13:04 dovecot_plain authenticator failed for H=(repters) [152.52.236.130]:47850: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-24 07:13:09 H=(localhost.localdomain) [45.150.192.143]:44566 F=<info@valencyexports.com> rejected RCPT <inquiries@ktlog.com.my>: SPF: 45.150.192.143 is not allowed to send mail from valencyexports.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.156.146.156
country_id: 2464461
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/admin/clients/create.blade.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.236.130
country_id: 1269750
description:
Jan 24 07:13:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.236.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 07:15:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.171
country_id: 3469034
description:
Jan 24 07:16:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.215
country_id: 3175395
description:
Jan 24 07:16:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.215 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.113.250
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=35681515980158 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.138.248.181
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603871 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 07:18:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.79.116
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=806383 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.97
country_id: 3996063
description:
Jan 24 07:20:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.116
country_id: 3469034
description:
Jan 24 07:21:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.205.161.101
country_id: 2017370
description:
[2026-01-24 07:21:33 +0800] info [cpaneld] 91.205.161.101 - manfor "GET /login/?login_only=1&user=manfor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manfor (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.97
country_id: 3996063
description:
Jan 24 07:21:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.77
country_id: 798544
description:
Jan 24 07:21:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.167.40.94
country_id: 1210997
description:
[2026-01-24 07:21:21 +0800] info [cpaneld] 103.167.40.94 - manforce "GET /login/?login_only=1&user=manforce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.89
country_id: 798544
description:
Jan 24 07:22:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.254.17
country_id: 3469034
description:
Jan 24 07:22:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.254.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.230.43.183
country_id: 3489940
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/css-selector/Node/PseudoNode.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.177.100
country_id: 3469034
description:
Jan 24 07:23:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.177.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.254.17
country_id: 3469034
description:
Jan 24 07:23:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.254.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.180
country_id: 3175395
description:
Jan 24 07:24:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.127
country_id: 798544
description:
Jan 24 07:24:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.104.75
country_id: 1269750
description:
Jan 24 07:25:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.104.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.104.75
country_id: 1269750
description:
Jan 24 07:26:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.104.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.119
country_id: 3469034
description:
Jan 24 07:26:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.184
country_id: 3865483
description:
Jan 24 07:27:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/fphortier/images/radiation.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.15.113.163
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-more.php?id=977802 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.58
country_id: 1269750
description:
Jan 24 07:28:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.18.252.225
country_id: 2661886
description:
Jan 24 07:27:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.18.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.22
country_id: 226074
description:
Jan 24 07:28:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.92
country_id: 3469034
description:
Jan 24 07:28:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.198.155
country_id: 2413451
description:
Jan 24 07:28:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.198.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.162
country_id: 953987
description:
Jan 24 07:29:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.248.94
country_id: 1814991
description:
Jan 24 07:29:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.248.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.22
country_id: 3469034
description:
Jan 24 07:29:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
country_id: 458258
description:
Jan 24 07:29:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-24 07:29:44 dovecot_plain authenticator failed for H=(spice) [178.250.191.189]:54600: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.58
country_id: 1269750
description:
Jan 24 07:29:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.7
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/named.root.key||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jan 24 07:29:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.195
country_id: 953987
description:
Jan 24 07:30:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.65.236.212
country_id: 1643084
domain: oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/defunct.dat||User:oxboldc||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-31.77.238.251.212||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.3
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/libaudit.conf||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 07:32:45 H=([45.144.212.242]) [45.144.212.242]:56707 F=<lynnied@mhtc.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.176.230.169
country_id: 3895114
domain: cabe.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:34.176.230.169||TA:34.176.230.169||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/images/home/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 07:37:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 07:38:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 07:43:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 07:43:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.246
country_id: 3469034
description:
Jan 24 07:44:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.180
country_id: 6252001
description:
Jan 24 07:45:50 sv3 pure-ftpd[2702161]: (?@147.185.132.180) [INFO] New connection from 147.185.132.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.162
country_id: 798544
description:
Jan 24 07:45:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 207.182.29.53
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block URI containing malicious URLs||RSV:7.67||T:APACHE||MVN:ARGS:url||SC:/home2/agsaintifik/public_html/wp-comments-post.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 07:47:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.24
country_id: 1269750
description:
Jan 24 07:47:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.253
country_id: 2510769
description:
Jan 24 07:49:16 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 07:51:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 07:51:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.98.159.24
country_id: 3865483
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/slide-page/construction-work HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.206.228
country_id: 3625428
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/global-state/src/Snapshot.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.237.23.100
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=90521514876899 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.169.78.148
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/geoclue/geoclue.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.34
country_id: 3175395
description:
Jan 24 07:53:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.181.36
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/gcb-product.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.197
country_id: 3469034
description:
Jan 24 07:54:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.237.202.48
country_id: 3996063
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/event-single.php?id=843185 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.250.159
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/event-single.php?id=141059 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.166.56
country_id: 3996063
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/fkrm-motor.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.44.137.54
country_id: 6252001
description:
198.44.137.54 - - [24/Jan/2026:07:57:31 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6921573&pdata=http%253A%252F%252Fwww.a-connect.global%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769212647 HTTP/1.1" 302 0 www.a-connect.global "http://www.a-connect.global:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.44.137.54


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.123.39
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-57.89.110.123.39||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 07:58:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 08:01:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 08:02:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.231.243
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:08-02.216.26.231.243||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.90
country_id: 3175395
description:
Jan 24 08:02:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 08:03:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.139
country_id: 3469034
description:
Jan 24 08:03:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.84
country_id: 3175395
description:
Jan 24 08:07:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.60
country_id: 953987
description:
Jan 24 08:07:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.60
country_id: 953987
description:
Jan 24 08:08:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.29.239.174
country_id: 1814991
description:
Jan 24 08:08:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.29.239.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.235
country_id: 1269750
description:
Jan 24 08:09:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.239.129.2
country_id: 1814991
description:
Jan 24 08:08:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.239.129.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.129.2
country_id: 1814991
description:
2026-01-24 08:09:01 dovecot_login authenticator failed for H=(3.129.239.124.broad.ts.he.dynamic.163data.com.cn) [124.239.129.2]:42724: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jan 24 08:10:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.193
country_id: 1269750
description:
Jan 24 08:11:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.225
country_id: 953987
description:
Jan 24 08:11:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.31
country_id: 953987
description:
Jan 24 08:11:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.31 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.161.77
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=21 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.31
country_id: 953987
description:
Jan 24 08:12:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.31 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.70.0
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-13.142.111.70.0||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 08:13:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 08:14:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.42
country_id: 798544
description:
Jan 24 08:17:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 08:18:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
country_id: 290557
description:
Jan 24 08:21:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-24 08:21:34 dovecot_plain authenticator failed for H=(eleilos) [5.32.22.218]:49022: 535 Incorrect authentication data (set_id=sales2@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.123.24
country_id: 3865483
description:
Jan 24 08:21:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.123.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.156
country_id: 953987
description:
Jan 24 08:21:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.123.24
country_id: 3865483
description:
Jan 24 08:22:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.123.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 24 08:22:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.190.132.134
country_id: 831053
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product.php?category&sub=High Solid Clear HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.148
country_id: 3175395
description:
Jan 24 08:23:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.119
country_id: 3469034
description:
Jan 24 08:24:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 08:23:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.148
country_id: 3175395
description:
Jan 24 08:24:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 08:25:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 08:26:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.163.51
country_id: 6252001
description:
[2026-01-24 08:27:34 +0800] info [webmaild] 191.102.163.51 - info@pspoly.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.155.38
country_id: 6252001
description:
[2026-01-24 08:27:35 +0800] info [webmaild] 191.102.155.38 - pspoly@pspoly.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 08:27:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 08:29:20 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57787: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 208.89.241.210
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-30.208.89.241.210||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 08:30:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57792: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.162
country_id: 3469034
description:
Jan 24 08:32:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 08:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57831: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.6
country_id: 798544
description:
Jan 24 08:32:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.28
country_id: 3865483
description:
Jan 24 08:33:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 08:35:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.159.165
country_id: 690791
description:
Jan 24 08:36:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.159.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 08:36:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58732: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.135.203
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=348656 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 08:37:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.227.176.57
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/banner-img-3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.170.191
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/cocoa.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.64.210.227
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/about-after-line.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 159.203.82.100
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/Cocoa-Raw-Beans-Chocolate.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.61.192.63
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.61.17.54
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/banner-icon.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.95.169.217
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/main_icon2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 136.227.160.198
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/about-before-line.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.50
country_id: 3469034
description:
Jan 24 08:41:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.12.192.117
country_id: 6252001
domain: www.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.krisfood.com/images/footer-bg.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.1
country_id: 3175395
description:
Jan 24 08:41:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.1 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.178
country_id: 6252001
description:
2026-01-24  8:42:42 631790 [Warning] Aborted connection 631790 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.178' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.91
country_id: 2510769
description:
Jan 24 08:42:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 08:42:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.79.122
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-42.92.71.79.122||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.91
country_id: 2510769
description:
Jan 24 08:42:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.200.135
country_id: 3469034
description:
Jan 24 08:43:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.200.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.123.39
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-44.89.110.123.39||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 08:44:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56802: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.224.237.93
country_id: 798544
description:
Jan 24 08:44:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.224.237.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 08:45:20 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56810: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.43.59
country_id: 6290252
description:
Jan 24 08:47:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.43.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.24.180.146
country_id: 1269750
description:
Jan 24 08:48:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.24.180.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.43.59
country_id: 6290252
description:
Jan 24 08:48:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.43.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.137.70
country_id: 99237
description:
Jan 24 08:48:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.137.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 08:49:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.214
country_id: 798544
description:
Jan 24 08:52:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.214
country_id: 798544
description:
Jan 24 08:53:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.220.84.251
country_id: 2017370
description:
Jan 24 08:55:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.220.84.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.220.84.251
country_id: 2017370
description:
2026-01-24 08:55:07 dovecot_plain authenticator failed for H=(cofreth.com.my) [37.220.84.251]:59684: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.100.90.134
country_id: 732800
description:
Jan 24 08:56:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.100.90.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.10.217.52
country_id: 3489940
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/2460079596.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-24 08:57:38 H=([77.83.39.187]) [77.83.39.187]:51229 F=<halkbank.bilgilendirme@bilgi.halkbank.com.tr> rejected RCPT <admin@fkr.com.my>: SPF: 77.83.39.187 is not allowed to send mail from bilgi.halkbank.com.tr


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.132
country_id: 3469034
description:
Jan 24 08:58:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 08:58:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.132
country_id: 3469034
description:
Jan 24 08:59:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.104.128
country_id: 1269750
description:
Jan 24 08:59:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.104.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.104.128
country_id: 1269750
description:
Jan 24 09:00:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.104.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.207.8.2
country_id: 2017370
description:
Jan 24 09:00:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.207.8.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.207.8.2
country_id: 2017370
description:
2026-01-24 09:00:07 dovecot_plain authenticator failed for H=(localhost) [178.207.8.2]:60317: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.148.56
country_id: 3469034
description:
Jan 24 09:01:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.148.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.252
country_id: 2300660
description:
Jan 24 09:01:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.20
country_id: 953987
description:
Jan 24 09:01:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.6
country_id: 3175395
description:
Jan 24 09:01:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.252
country_id: 2300660
description:
Jan 24 09:02:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 09:02:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.33
country_id: 3865483
description:
Jan 24 09:02:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 09:04:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.34
country_id: 3865483
description:
Jan 24 09:09:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 09:09:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 09:10:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.184
country_id: 298795
description:
Jan 24 09:12:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.135.138
country_id: 1168579
description:
Jan 24 09:13:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.135.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 09:13:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61434: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.184
country_id: 298795
description:
Jan 24 09:13:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.78
country_id: 3469034
description:
Jan 24 09:13:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.192.33
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=791633 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.128.235
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/JsonResponseTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.196.216.19
country_id: 3508796
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=641998 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.210.109
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=51551514941965 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.85
country_id: 3996063
description:
Jan 24 09:23:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.85 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-24 09:25:41 +0800] info [cpaneld] 202.178.120.157 - KIk! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.29.229.162
country_id: 690791
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-26.82.29.229.162||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/transports.db||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.130.99.181
country_id: 1210997
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=19 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.105.105
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-30.166.0.105.105||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.121.234.133
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/RequestTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77166413
name: IM360 WAF: The Events Calendar - Potential SQL Injection in order parameter (CVE-2024-8275)
abuser: 45.129.59.81
country_id: 2661886
domain: www.box.com.my
description:
IM360 WAF: The Events Calendar - Potential SQL Injection in order parameter (CVE-2024-8275)||MV:asc'||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.86
country_id: 3469034
description:
Jan 24 09:34:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 09:34:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.244.140.226
country_id: 1282988
description:
[2026-01-24 09:35:37 +0800] info [cpaneld] 49.244.140.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.103.241.181
country_id: 3469034
description:
[2026-01-24 09:35:40 +0800] info [whostmgrd] 200.103.241.181 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.178.74.47
country_id: 2510769
description:
[2026-01-24 09:35:41 +0800] info [cpaneld] 92.178.74.47 - boxcommy "GET /login/?login_only=1&user=boxcommy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boxcommy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.101.210.250
country_id: 6252001
description:
[2026-01-24 09:35:45 +0800] info [cpaneld] 68.101.210.250 - bo "GET /login/?login_only=1&user=bo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bo (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.86
country_id: 3469034
description:
Jan 24 09:35:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.196.72.34
country_id: 3658394
description:
[2026-01-24 09:35:35 +0800] info [cpaneld] 181.196.72.34 - box "GET /login/?login_only=1&user=box&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user box (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 09:36:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/asound.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.55.20.109
country_id: 3686110
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/images/content/clients/renault.jpeg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.224.0.218
country_id: 3469034
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/images/content/clients/nissan1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.74.241.188
country_id: 3469034
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/assets/71110014155176345.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/chrony.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.224.215.89
country_id: 3865483
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/images/content/clients/ford.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.224.94
country_id: 3625428
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.41.40.129
country_id: 3625428
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/images/logo.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.152.67
country_id: 1562822
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/images/content/clients/mazda.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.108.139
country_id: 1562822
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/images/content/clients/jaguar.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.206.15.1
country_id: 1269750
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/js/jquery.themepunch.tools.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.9.148
country_id: 1562822
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/images/content/clients/vauxhall.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.121.66
country_id: 1269750
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/assets/blink1.gif HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.214.3.240
country_id: 2245662
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/images/content/clients/toyota.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.41.41.144
country_id: 3625428
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/images/content/clients/honda.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.75.207.19
country_id: 2542007
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/images/logo1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/cpbackup-exclude.conf||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 207.182.29.134
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-39.207.182.29.134||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.228.132
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=3&sub=24 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 09:40:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.250.25.110
country_id: 2661886
description:
[2026-01-24 09:41:57 +0800] info [cpaneld] 83.250.25.110 - nobledec "GET /login/?login_only=1&user=nobledec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 09:41:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51638: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 09:41:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.196.179.133
country_id: 1643084
description:
[2026-01-24 09:42:05 +0800] info [cpaneld] 103.196.179.133 - nobledeccom "GET /login/?login_only=1&user=nobledeccom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nobledeccom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.110.187.112
country_id: 6252001
description:
[2026-01-24 09:42:08 +0800] info [cpaneld] 99.110.187.112 - noblede "GET /login/?login_only=1&user=noblede&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user noblede (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.129.249
country_id: 6252001
description:
[2026-01-24 09:42:13 +0800] info [cpaneld] 129.222.129.249 - nobled "GET /login/?login_only=1&user=nobled&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nobled (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.201.229.229
country_id: 2921044
description:
[2026-01-24 09:42:20 +0800] info [cpaneld] 37.201.229.229 - nob "GET /login/?login_only=1&user=nob&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user nob (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.14.38
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-42.168.91.14.38||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dracut.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.13.49.70
country_id: 3469034
description:
[2026-01-24 09:42:16 +0800] info [cpaneld] 191.13.49.70 - noble "GET /login/?login_only=1&user=noble&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user noble (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.237.56.60
country_id: 3469034
description:
[2026-01-24 09:42:22 +0800] info [cpaneld] 152.237.56.60 - no "GET /login/?login_only=1&user=no&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user no (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.245.82.202
country_id: 3469034
description:
[2026-01-24 09:42:00 +0800] info [cpaneld] 170.245.82.202 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/freetds.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.183.227
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=53541520647587 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.65.135.21
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/maennchen/zipstream-php/test/bootstrap.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.72.174
country_id: 798544
description:
Jan 24 09:46:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.72.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.94
country_id: 226074
description:
Jan 24 09:46:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/kdump.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.66.51
country_id: 1282988
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/ResponseTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.124.234.61
country_id: 3437598
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/narrative.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/locale.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.5.85.6
country_id: 1269750
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/activity-details.php?id=607635 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/man_db.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.1.106
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/services.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.186.45
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news-details6.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/named.conf||User:named||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.38.110
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/training-details.php?id=449036 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/nscd.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.74.190
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/listing-details.php?id=23850891 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/133.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pcp.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.97.78
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/news.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.4.52
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/activity-details.php?id=894765 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.128.110.158
country_id: 953987
description:
Jan 24 09:53:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.128.110.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.128.110.158
country_id: 953987
description:
Jan 24 09:53:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.128.110.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pure-ftpd.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 09:55:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-24 09:55:08 +0800] info [cpaneld] 202.178.120.157 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/request-key.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/resolv.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sestatus.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/stats.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.182.5
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=2&sub=6 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sysctl.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 09:59:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-24 10:00:05 H=([127.0.0.1]) [103.197.57.71]:55356 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.135.77.231
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/code-unit-reverse-lookup/LICENSE HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/vconsole.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.84
country_id: 2395170
description:
Jan 24 10:01:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.209
country_id: 3469034
description:
Jan 24 10:01:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/xattr.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.122.171.222
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=66 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 10:02:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.198
country_id: 3469034
description:
Jan 24 10:03:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.67
country_id: 3175395
description:
Jan 24 10:04:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 10:04:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2026-01-24 10:06:33 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:50724: 535 Incorrect authentication data


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib64/cracklib_dict.pwd||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.26
country_id: 3175395
description:
Jan 24 10:10:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.23
country_id: 3469034
description:
Jan 24 10:10:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.162
country_id: 1269750
description:
Jan 24 10:10:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.111.174
country_id: 6252001
description:
2026-01-24 10:13:30 dovecot_login authenticator failed for H=([127.0.0.1]) [76.178.111.174]:58960: 535 Incorrect authentication data (set_id=info@jabezinnovations.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.41.72
country_id: 3469034
description:
Jan 24 10:17:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.41.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.133.51.89
country_id: 798544
description:
Jan 24 10:17:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.133.51.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 10:18:31 H=([45.144.212.242]) [45.144.212.242]:63652 F=<lynnied@mhtc.net> rejected RCPT <sales@wcc.com.my>: Rejected relay attempt: '45.144.212.242' From: 'lynnied@mhtc.net' To: 'sales@wcc.com.my'


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.164
country_id: 3469034
description:
Jan 24 10:18:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.165.111
country_id: 1835841
description:
Jan 24 10:19:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.165.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-01-24 10:20:00 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:45496: 535 Incorrect authentication data (set_id=feedback@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.65.173
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=459480 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 10:21:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.114.171
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=449403 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.129.255.180
country_id: 3469034
description:
Jan 24 10:25:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.129.255.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.44
country_id: 3469034
description:
Jan 24 10:25:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 10:26:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.160
country_id: 3469034
description:
Jan 24 10:30:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 10:30:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.99.34
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=825907 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.12.200
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=68&page=7 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 82.180.145.166
country_id: 1269750
domain: www.dsc-expat.com
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:\xadd cgi.force_redirect=0 \xadd cgi.redirect_status_env \xadd allow_url_include=1 \xadd auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.107
country_id: 3175395
description:
Jan 24 10:38:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.154.172
country_id: 1733045
description:
Jan 24 10:40:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.154.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.172
country_id: 1733045
description:
2026-01-24 10:41:01 dovecot_login authenticator failed for H=([49.124.154.172]) [49.124.154.172]:48318: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.159
country_id: 953987
description:
Jan 24 10:42:13 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.146.179
country_id: 3469034
description:
Jan 24 10:42:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.146.179 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.134.233
country_id: 6252001
description:
2026-01-24 10:42:41 636179 [Warning] Aborted connection 636179 to db: 'unconnected' user: 'unauthenticated' host: '71.6.134.233' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.100.90
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=8 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.82.70
country_id: 1269750
description:
Jan 24 10:46:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.82.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.118.79.242
country_id: 2542007
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=972941 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.98
country_id: 798544
description:
Jan 24 10:49:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.232
country_id: 3175395
description:
Jan 24 10:52:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.180
country_id: 953987
description:
Jan 24 10:53:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.40.137
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-56.168.91.40.137||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 10:58:09 H=([45.144.212.242]) [45.144.212.242]:58443 F=<lynnied@mhtc.net> rejected RCPT <simon@wcc.com.my>: Rejected relay attempt: '45.144.212.242' From: 'lynnied@mhtc.net' To: 'simon@wcc.com.my'


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.206.121.101
country_id: 1269750
description:
Jan 24 10:58:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.206.121.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.206.121.101
country_id: 1269750
description:
2026-01-24 10:58:40 dovecot_plain authenticator failed for H=(kjutn8dii19b4xesfl2fn4dg1csrim) [117.206.121.101]:45724: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.92
country_id: 3865483
description:
Jan 24 11:02:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.92 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 1.32.102.121
country_id: 1733045
description:
[2026-01-24 11:02:46 +0800] info [webmaild] 1.32.102.121 - jlpom@ajplantations.com.my "GET /cpsess2601267093/3rdparty/roundcube/?_task=settings HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.8.48
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=1&sub=24 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.217
country_id: 3996063
description:
Jan 24 11:03:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.217
country_id: 3996063
description:
Jan 24 11:04:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.119
country_id: 3469034
description:
Jan 24 11:04:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.158.23
country_id: 1861060
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/img/product/Rolled Top Fence.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.85.35.51
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteLineChart3.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.9
country_id: 3175395
description:
Jan 24 11:06:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.98
country_id: 226074
description:
Jan 24 11:07:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.8.49
country_id: 2300660
description:
Jan 24 11:09:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.8.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.181
country_id: 798544
description:
Jan 24 11:10:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.182.218
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=547334 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.28.181.78
country_id: 2017370
description:
Jan 24 11:15:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.28.181.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.28.181.78
country_id: 2017370
description:
2026-01-24 11:15:12 dovecot_login authenticator failed for H=([37.28.181.78]) [37.28.181.78]:41958: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.113
country_id: 1814991
description:
Jan 24 11:15:35 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.113
country_id: 1814991
description:
2026-01-24 11:15:37 dovecot_login authenticator failed for H=(113.20.167.124.adsl-pool.sx.cn) [124.167.20.113]:34124: 535 Incorrect authentication data (set_id=salesi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 11:17:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 11:18:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.136
country_id: 2017370
description:
Jan 24 11:19:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
country_id: 2017370
description:
2026-01-24 11:19:24 dovecot_login authenticator failed for H=([178.178.194.136]) [178.178.194.136]:54542: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 11:21:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.70
country_id: 1814991
description:
Jan 24 11:23:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-01-24 11:23:02 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:56972: 535 Incorrect authentication data (set_id=hr@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
country_id: 1814991
description:
Jan 24 11:23:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2026-01-24 11:23:05 dovecot_login authenticator failed for H=([60.8.73.174]) [60.8.73.174]:65390: 535 Incorrect authentication data (set_id=hr@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.234.145
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/about.asp HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-30.77.238.251.212||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 11:31:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.232.11
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=583388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.109.168.244
country_id: 3469034
description:
Jan 24 11:32:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.109.168.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.112
country_id: 798544
description:
Jan 24 11:32:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.3
country_id: 719819
description:
Jan 24 11:32:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.214
country_id: 3865483
description:
Jan 24 11:32:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/m.me/img/csr.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.191.223.214
country_id: 3865483
description:
Jan 24 11:33:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.191.223.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 11:33:31 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60337: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.94.5.44
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-33.23.94.5.44||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 11:34:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54629: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.5
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/chkservd.log||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 11:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54655: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.3
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/mke2fs.conf||User:root||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 118.194.250.245
country_id: 1605651
description:
2026-01-24 11:39:41 638170 [Warning] Aborted connection 638170 to db: 'unconnected' user: 'unauthenticated' host: '118.194.250.245' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.182
country_id: 3175395
description:
Jan 24 11:39:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 11:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54683: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.76
country_id: 3996063
description:
Jan 24 11:40:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.76 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.182
country_id: 3175395
description:
Jan 24 11:40:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.234
country_id: 1269750
description:
Jan 24 11:41:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.2
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/limits.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.46
country_id: 3469034
description:
Jan 24 11:41:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.46
country_id: 3469034
description:
Jan 24 11:41:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.9.5
country_id: 2300660
description:
Jan 24 11:44:05 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.9.5 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.101.109.50
country_id: 290557
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-45.191.101.109.50||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 11:46:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 11:48:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53412: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.250.11.210
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57481515047163 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.52
country_id: 3175395
description:
Jan 24 11:48:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.71
country_id: 953987
description:
Jan 24 11:48:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.55
country_id: 953987
description:
Jan 24 11:48:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.146
country_id: 3469034
description:
Jan 24 11:48:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.178
country_id: 953987
description:
Jan 24 11:48:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.27
country_id: 3469034
description:
Jan 24 11:49:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.71
country_id: 953987
description:
Jan 24 11:49:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.240
country_id: 298795
description:
Jan 24 11:49:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.91
country_id: 3469034
description:
Jan 24 11:49:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.52
country_id: 3175395
description:
Jan 24 11:49:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.55
country_id: 953987
description:
Jan 24 11:49:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.178
country_id: 953987
description:
Jan 24 11:49:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.146
country_id: 3469034
description:
Jan 24 11:49:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.166.137
country_id: 3469034
description:
Jan 24 11:49:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.166.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.190
country_id: 798544
description:
Jan 24 11:49:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 11:49:42 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.213.36
country_id: 798544
description:
Jan 24 11:50:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.213.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 11:53:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 11:54:12 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:42030: 535 Incorrect authentication data (set_id=legal@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.150.98.193
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=47581515570593 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.202.69.236
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-54.46.202.69.236||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.142
country_id: 3469034
description:
Jan 24 11:56:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 11:56:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.110
country_id: 3469034
description:
Jan 24 11:56:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.57
country_id: 3469034
description:
Jan 24 11:57:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.57 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.20.167.133
country_id: 3658394
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=444310 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 11:57:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.146
country_id: 3469034
description:
Jan 24 11:59:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 12:01:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 162.244.145.40
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-02.162.244.145.40||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 12:04:08 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53428: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.52.217
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=679911 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.55.251
country_id: 1562822
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/index.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.69.20.178
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=913632 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.59
country_id: 2017370
description:
2026-01-24 12:07:38 dovecot_login authenticator failed for H=([178.178.222.59]) [178.178.222.59]:43310: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.59
country_id: 2017370
description:
Jan 24 12:07:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.103
country_id: 3469034
description:
Jan 24 12:08:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/images/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.97.103
country_id: 3469034
description:
Jan 24 12:08:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.97.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/home/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 203.144.76.188
country_id: 1831722
description:
Jan 24 12:10:08 sv3 pure-ftpd[2909533]: (?@203.144.76.188) [WARNING] Authentication failed for user [hrd]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.144.76.188
country_id: 1831722
description:
Jan 24 12:10:04 sv3 pure-ftpd[2909533]: (?@203.144.76.188) [INFO] New connection from 203.144.76.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.213
country_id: 3865483
description:
Jan 24 12:12:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.99
country_id: 3175395
description:
Jan 24 12:12:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.199.34
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=30 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.157.212.152
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-13.185.157.212.152||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.80
country_id: 2510769
description:
Jan 24 12:14:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 12:14:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.65.195
country_id: 3469034
description:
Jan 24 12:14:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.65.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.181.22.22
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30831516782659 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.222.93.170
country_id: 1814991
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/js/owl.carousel.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.110.127.222
country_id: 1814991
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.140.132.13
country_id: 1814991
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/css/font-awesome.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.80.107.68
country_id: 1814991
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/css/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.51.186.154
country_id: 1814991
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/js/jquery-3.2.1.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.217.210
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=40 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 120.8.208.17
country_id: 1814991
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/css/owl.theme.default.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.255.21.29
country_id: 1814991
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/css/main.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.135.59.143
country_id: 1814991
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/js/main.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.154.133.20
country_id: 1814991
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.39.215.176
country_id: 1814991
domain: www.euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.euratech.com.my/js/bootstrap.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-16.77.238.251.212||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-24 12:19:24 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:55424: 535 Incorrect authentication data (set_id=legal@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.87.28.17
country_id: 3686110
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=92771514967202 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
country_id: 1814991
description:
Jan 24 12:19:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
country_id: 1814991
description:
Jan 24 12:20:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-01-24 12:20:12 dovecot_login authenticator failed for H=([116.114.94.242]) [116.114.94.242]:34674: 535 Incorrect authentication data (set_id=legal@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 218.15.155.208
country_id: 1814991
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/HTWF/scripts/flexslider/flexslider.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.45.5.54
country_id: 1814991
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/HTWF/css/image-box.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.254.124.70
country_id: 1814991
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/HTWF/scripts/jquery.twbsPagination.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.47.252.53
country_id: 1814991
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/HTWF/css/animations.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.114.162.39
country_id: 1814991
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/HTWF/scripts/iconsmind/line-icons-fonts/social.ttf HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.148.142.70
country_id: 1814991
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/HTWF/scripts/iconsmind/line-icons-fonts/icomoon.woff HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.70.26
country_id: 294640
description:
Jan 24 12:22:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.70.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2026-01-24 12:22:09 dovecot_login authenticator failed for H=([2.55.70.26]) [2.55.70.26]:35271: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 12:22:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.4.191.81
country_id: 1814991
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/HTWF/scripts/smooth.scroll.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/images/csr.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.143
country_id: 3469034
description:
Jan 24 12:23:27 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.166.133.156
country_id: 690791
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/intervention/image/src/Intervention/Image/Facades HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.172.9.85
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/intervention/image/src/Intervention/Image/Facades/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.151
country_id: 953987
description:
Jan 24 12:25:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 12:25:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.132.199
country_id: 690791
description:
Jan 24 12:26:57 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.132.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.132.199
country_id: 690791
description:
Jan 24 12:27:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.132.199 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.158.158.225
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/fzaninotto/faker/src/Faker/Calculator/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 12:27:36 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.124.196.172
country_id: 2782113
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=62&page=6 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.220.216
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/fzaninotto/faker/src/Faker/Calculator HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 12:29:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.78.241
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=89 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.226.213
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=39721515376362 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 12:32:21 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53466: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 12:34:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.200.181.45
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-token-stream/tests/Token HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.219.67.65
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-token-stream/tests/Token/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.253.213.116
country_id: 587116
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/contact-us HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 12:38:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.168.12
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95421514528009 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.156.189.57
country_id: 1210997
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/5773924170.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.87.130
country_id: 1733045
description:
[2026-01-24 12:44:01 +0800] info [webmaild] 115.164.87.130 - sayuthiy@ajresorts.com.my "POST /cpsess0347477550/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [58.26.187.195] != Current IP Address [115.164.87.130]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/design-proposal.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77277975
name: IM360 WAF: XMLRPC getUsersBlogs RBL brute
abuser: 130.49.9.228
country_id: 3017382
domain: www.saps.com.my
description:
IM360 WAF: XMLRPC getUsersBlogs RBL brute||Username:dag3753.www.saps.com.my||Method:wp.getUsersBlogs


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.114
country_id: 1733045
description:
[2026-01-24 12:47:19 +0800] info [webmaild] 161.142.118.114 - s-osada@mckd.com.my "GET /cpsess3347851325/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D1%2Cwebp%3D1%2Cpgpmime%3D0&_uid=38646&_mbox=INBOX&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-24 12:47:41 H=([45.144.212.242]) [45.144.212.242]:50133 F=<lynnied@mhtc.net> rejected RCPT <vincent@wcc.com.my>: Rejected relay attempt: '45.144.212.242' From: 'lynnied@mhtc.net' To: 'vincent@wcc.com.my'


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.51.133
country_id: 732800
description:
[2026-01-24 12:47:48 +0800] info [webmaild] 95.164.51.133 - sales@cordage.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.159.242
country_id: 6252001
description:
[2026-01-24 12:47:50 +0800] info [webmaild] 191.102.159.242 - cordage@cordage.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 12:48:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 12:49:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 12:50:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 12:51:19 sv3 pure-ftpd[2940262]: (?@175.143.194.178) [INFO] New connection from 175.143.194.178


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 12:51:25 sv3 pure-ftpd[2940262]: (?@175.143.194.178) [WARNING] Authentication failed for user [oxboldc]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.140
country_id: 798544
description:
Jan 24 12:51:41 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.140 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 12:52:08 sv3 pure-ftpd[2940749]: (?@175.143.194.178) [WARNING] Authentication failed for user [oxboldc]


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 12:52:19 sv3 pure-ftpd[2941056]: (?@175.143.194.178) [WARNING] Authentication failed for user [oxboldc]


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 12:52:52 sv3 pure-ftpd[2941298]: (?@175.143.194.178) [WARNING] Authentication failed for user [oxboldc]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 12:52:03 sv3 pure-ftpd[2940749]: (?@175.143.194.178) [INFO] New connection from 175.143.194.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 12:52:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 12:53:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.245.145.122
country_id: 6290252
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=98791515724549 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 12:55:09 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:35138: 535 Incorrect authentication data (set_id=media@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.121
country_id: 6290252
description:
Jan 24 12:56:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/NetworkManager/NetworkManager.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.106
country_id: 3175395
description:
Jan 24 12:56:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 12:57:46 sv3 pure-ftpd[2944793]: (?@175.143.194.178) [INFO] New connection from 175.143.194.178


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 12:57:50 sv3 pure-ftpd[2944793]: (?@175.143.194.178) [WARNING] Authentication failed for user [oxboldc]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.84
country_id: 2510769
description:
Jan 24 12:57:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.84
country_id: 2510769
description:
Jan 24 12:58:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.70.88
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=138029 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 12:59:41 sv3 pure-ftpd[2946011]: (?@175.143.194.178) [INFO] New connection from 175.143.194.178


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 12:59:46 sv3 pure-ftpd[2946011]: (?@175.143.194.178) [WARNING] Authentication failed for user [oxboldc]


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/authselect/user-nsswitch.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 13:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51250: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/check_mk/super-server.cfg||User:root||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 13:00:11 sv3 pure-ftpd[2946550]: (?@175.143.194.178) [INFO] New connection from 175.143.194.178


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.157.212.152
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-00.185.157.212.152||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 175.143.194.178
country_id: 1733045
description:
Jan 24 13:00:15 sv3 pure-ftpd[2946550]: (?@175.143.194.178) [WARNING] Authentication failed for user [oxboldc]


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/cl.selector/selector.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/cloudlinux-backup/mysql_freeze.config||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 13:02:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 13:03:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dbus-1/session.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/depmod.d/dist.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dovecot/auth_policy.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.161.156
country_id: 337996
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/ServerBagTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.185.41.20
country_id: 1814991
description:
Jan 24 13:07:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.185.41.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.185.41.20
country_id: 1814991
description:
2026-01-24 13:07:17 dovecot_login authenticator failed for H=([27.185.41.20]) [27.185.41.20]:49460: 535 Incorrect authentication data (set_id=media@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 13:07:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/fonts/fonts.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 13:08:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/gssproxy/24-nfs-server.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.221.214.3
country_id: 2017370
description:
Jan 24 13:09:22 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.221.214.3 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/imunify360-webshield/agent-proxies.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 13:10:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/imunify360-webshield/webshield.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 13:12:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.221.214.3
country_id: 2017370
description:
Jan 24 13:13:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.221.214.3 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/ld.so.conf.d/alt-hyperscan.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 13:13:37 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.140.123.4
country_id: 6290252
description:
Jan 24 13:13:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.140.123.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.72.220
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-14.142.111.72.220||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.112
country_id: 3175395
description:
Jan 24 13:14:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.200.48.216
country_id: 3175395
description:
Jan 24 13:14:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.200.48.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/libssh/libssh_client.config||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.200.48.216
country_id: 3175395
description:
Jan 24 13:14:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.200.48.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/libssh/libssh_server.config||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 13:15:08 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.246.57.226
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/pftfood/cpbackup-exclude.conf||User:pftfood||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.167
country_id: 3469034
description:
Jan 24 13:16:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.167 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/lvm/lvm.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.167
country_id: 3469034
description:
Jan 24 13:17:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.167 has been locked due to Imunify RBL


plugin: modsec
rule: 77317988
name: IM360 WAF: Block access to quarantined files
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Block access to quarantined files||RSV:7.67||T:APACHE||MVN:REQUEST_URI||MV:/home/000~root~000/home3.ori/pftfood/quarantine_clamavconnector/||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.150.115
country_id: 1819730
description:
Jan 24 13:17:31 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.150.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2026-01-24 13:17:33 dovecot_login authenticator failed for H=115.150.48.116.static.netvigator.com [116.48.150.115]:60078: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 13:18:33 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/modprobe.d/firewalld-sysctls.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/openldap/ldap.conf||User:root||


