# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.241.171.19
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=92381526630256 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 60.52.141.180
country_id: 1733045
domain: agsaintifik.com.my
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.62||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/38/feedback||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.136.221
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=58 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.128.66.114
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=83&page=2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 60.52.141.180
country_id: 1733045
domain: agsaintifik.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/38/feedback||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.183.93.32
country_id: 2017370
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-41.93.183.93.32||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.177
country_id: 953987
description:
Jan 13 15:43:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 15:45:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45482: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 164.163.133.156
country_id: 3658394
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Loader HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 15:45:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45482: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 15:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57856: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.101.14.34
country_id: 690791
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Loader/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 15:47:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57856: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.158
country_id: 1269750
description:
Jan 13 15:48:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.47
country_id: 3469034
description:
Jan 13 15:51:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.209.140
country_id: 798544
description:
Jan 13 15:52:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.209.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.198.168
country_id: 2510769
description:
Jan 13 15:52:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.198.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.129.206.9
country_id: 3469034
description:
Jan 13 15:52:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.129.206.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.109.115
country_id: 798544
description:
Jan 13 15:52:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.109.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.139.180.140
country_id: 3175395
description:
Jan 13 15:53:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.139.180.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 15:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60043: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 15:55:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60044: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.36.4
country_id: 3469034
description:
[2026-01-13 15:55:31 +0800] info [cpaneld] 181.189.36.4 - urban "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.243
country_id: 2300660
description:
Jan 13 15:56:52 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 15:57:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.223
country_id: 690791
description:
Jan 13 15:56:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.211.212.21
country_id: 1733045
description:
2026-01-13 15:57:48 H=([192.168.1.6]) [113.211.212.21]:3606 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<vasundra@egbwawasan.com.my> A=dovecot_login:vasundra@egbwawasan.com.my temporarily rejected RCPT <SweatLing.Kor@kerrylogistics.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:58:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55614: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.236.96
country_id: 3469034
description:
Jan 13 15:57:25 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 211.25.18.142
country_id: 1733045
description:
[2026-01-13 15:58:57 +0800] info [webmaild] 211.25.18.142 - safuddin@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 15:58:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55614: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.211.212.21
country_id: 1733045
description:
2026-01-13 15:58:12 H=([192.168.1.6]) [113.211.212.21]:3628 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<vasundra@egbwawasan.com.my> A=dovecot_login:vasundra@egbwawasan.com.my temporarily rejected RCPT <SweatLing.Kor@kerrylogistics.com>: host lookup did not complete


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-01-13 15:59:47 2529519 [Warning] Aborted connection 2529519 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-01-13 16:01:53 2529632 [Warning] Aborted connection 2529632 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-13 16:02:53 H=([45.144.212.54]) [45.144.212.54]:62196 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 192.241.133.142
country_id: 6252001
description:
2026-01-13 16:04:02 2529858 [Warning] Aborted connection 2529858 to db: 'unconnected' user: 'unauthenticated' host: '192.241.133.142' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 142.93.49.186
country_id: 6252001
description:
2026-01-13 16:03:20 2529832 [Warning] Aborted connection 2529832 to db: 'unconnected' user: 'unauthenticated' host: '142.93.49.186' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 104.248.122.5
country_id: 6252001
description:
2026-01-13 16:03:21 2529835 [Warning] Aborted connection 2529835 to db: 'unconnected' user: 'unauthenticated' host: '104.248.122.5' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 67.227.126.167
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-04.67.227.126.167||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 13 16:05:47 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.66.4
country_id: 3469034
description:
Jan 13 16:05:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.66.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.36.0.89
country_id: 6252001
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/loreal/loreal-luxe/yuesai/index.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.135
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/themes/LorealCorp/css/bundle187b.css?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.252
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/themes/LorealCorp/css/chunk-04eeced9.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.248
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/themes/LorealCorp/bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.153
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/cdn-cgi/challenge-platform/h/g/scripts/jsd/7a55c9ccbaaa/maind41d.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.235.7
country_id: 3175395
description:
Jan 13 16:06:20 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.235.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.239
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/cdn.cookielaw.org/scripttemplates/otSDKStub.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.209
country_id: 1880251
domain: www.working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.working.magsoft.com.my/themes/LorealCorp/vendors.bundle187b.js?v=2.69.0-release00000003 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.132.166
country_id: 3175395
description:
Jan 13 16:08:48 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.132.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.219
country_id: 3175395
description:
Jan 13 16:09:02 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.30
country_id: 690791
description:
Jan 13 16:08:29 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.74.102
country_id: 3469034
description:
Jan 13 16:08:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.74.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.219
country_id: 3175395
description:
Jan 13 16:09:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.163
country_id: 3175395
description:
Jan 13 16:09:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.56
country_id: 953987
description:
Jan 13 16:09:55 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.56 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 138.197.167.148
country_id: 6251999
description:
2026-01-13 16:09:55 2530142 [Warning] Aborted connection 2530142 to db: 'unconnected' user: 'unauthenticated' host: '138.197.167.148' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.121
country_id: 2750405
description:
2026-01-13 16:10:01 2530147 [Warning] Aborted connection 2530147 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.121' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/m.me/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.56
country_id: 953987
description:
Jan 13 16:10:10 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:13:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45490: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:13:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45491: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57867: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 101.47.135.225
country_id: 1880251
domain: www.geminiflourmill.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/webdesign.monkeymedia2u.com||User:cabecom||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.121
country_id: 2750405
description:
2026-01-13 16:14:30 2530310 [Warning] Aborted connection 2530310 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.121' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
country_id: 1814991
description:
Jan 13 16:14:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2026-01-13 16:14:33 dovecot_login authenticator failed for H=([39.164.91.67]) [39.164.91.67]:49830: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.17.213.162
country_id: 1814991
description:
Jan 13 16:15:38 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.17.213.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.17.213.162
country_id: 1814991
description:
2026-01-13 16:15:40 dovecot_login authenticator failed for H=([111.17.213.162]) [111.17.213.162]:59574: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:15:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57869: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.197.236.163
country_id: 6252001
description:
Jan 13 16:16:54 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.197.236.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-13 16:16:56 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (hyotole) [73.197.236.163]:53548: 535 Incorrect authentication data (set_id=admin@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.121
country_id: 2750405
description:
2026-01-13 16:17:58 2530472 [Warning] Aborted connection 2530472 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.121' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.40.225.172
country_id: 286963
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/properties.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-17.77.238.251.212||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.192.207.119
country_id: 798544
description:
Jan 13 16:18:46 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.192.207.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-18.77.238.251.212||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.235.225.181
country_id: 6252001
description:
Jan 13 16:18:17 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.235.225.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-13 16:18:19 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (haranta) [71.235.225.181]:35802: 535 Incorrect authentication data (set_id=tankimmeng@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 16:19:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.225
country_id: 1269750
description:
Jan 13 16:19:40 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-01-13 16:20:36 dovecot_login authenticator failed for H=(nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:47337: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.68
country_id: 2395170
description:
Jan 13 16:20:11 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.54
country_id: 1269750
description:
Jan 13 16:20:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.92.186.101
country_id: 614540
description:
Jan 13 16:20:49 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.92.186.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.209.1
country_id: 1733045
description:
2026-01-13 16:21:03 dovecot_login authenticator failed for H=([183.171.209.1]) [183.171.209.1]:44184: 535 Incorrect authentication data (set_id=safuddin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.171.209.1
country_id: 1733045
description:
Jan 13 16:21:01 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.171.209.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.70.52.180
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/ritzleder.php?id=23&sub=6 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.165
country_id: 3865483
description:
Jan 13 16:21:31 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.27
country_id: 1733045
description:
[2026-01-13 16:21:42 +0800] info [webmaild] 27.125.241.27 - jlpom@ajplantations.com.my "POST /cpsess0058041653/3rdparty/roundcube/?_task=mail&_remote=1&_from=compose&_id=510548620696600803f9d5&_uploadid=upload1768292504511&_action=upload HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.117] != Current IP Address [27.125.241.27]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.141
country_id: 1733045
description:
[2026-01-13 16:22:03 +0800] info [webmaild] 27.125.241.141 - jlpom@ajplantations.com.my "GET /cpsess5630179490/3rdparty/roundcube/?_task=mail&_mbox=INBOX&login=1&post_login=5177453406789 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.27] != Current IP Address [27.125.241.141]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.249
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-22.92.71.74.249||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 16:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60166: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/img/photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.167.219
country_id: 163843
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f006/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 16:24:07 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.142.152.128
country_id: 1733045
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/flag/12/60/1200060 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 16:23:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60168: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.242.219.58
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f006 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.241.117
country_id: 1733045
description:
[2026-01-13 16:23:11 +0800] info [webmaild] 27.125.241.117 - jlpom@ajplantations.com.my "GET /cpsess2226752447/3rdparty/roundcube/?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1768292593155 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.241.162] != Current IP Address [27.125.241.117]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/img/druma_photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.28
country_id: 3175395
description:
Jan 13 16:25:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.111.54
country_id: 798544
description:
Jan 13 16:25:36 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.111.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/home/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 16:26:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55681: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.99.249
country_id: 3469034
description:
Jan 13 16:26:19 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.99.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.5
country_id: 3469034
description:
Jan 13 16:26:37 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 16:26:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55682: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 16:29:50 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 5.35.68.141
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-29.5.35.68.141||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.84.109
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-29.89.110.84.109||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.231
country_id: 3865483
description:
Jan 13 16:31:03 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.255.224
country_id: 3996063
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/product&product_id=374 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.255.224
country_id: 3996063
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/?route=product/product&product_id=374 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.204.150.164
country_id: 2017370
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/?route=product/category&path=35&limit=100 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.204.150.164
country_id: 2017370
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/category&path=35&limit=100 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.231
country_id: 3865483
description:
Jan 13 16:31:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.12
country_id: 798544
description:
Jan 13 16:33:04 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 75.115.213.55
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-32.75.115.213.55||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.98
country_id: 798544
description:
Jan 13 16:33:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.12
country_id: 798544
description:
Jan 13 16:33:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.132.248.149
country_id: 1733045
description:
[2026-01-13 16:35:08 +0800] info [webmaild] 115.132.248.149 - admin@aire-fresh.com "GET /cpsess4391916755/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.84.125.83
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-35.91.84.125.83||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.19.119.252
country_id: 798544
description:
Jan 13 16:38:07 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.19.119.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.19.119.252
country_id: 798544
description:
Jan 13 16:38:14 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.19.119.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.139.180.120
country_id: 3175395
description:
Jan 13 16:38:26 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.139.180.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.70.69.206
country_id: 3469034
description:
Jan 13 16:38:36 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.70.69.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.97.251.240
country_id: 798544
description:
Jan 13 16:39:27 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.97.251.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.241.224
country_id: 798544
description:
Jan 13 16:39:45 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.241.224 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:41:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45493: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.68.237
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-code-coverage/LICENSE HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/img/photos/contact.php||SC:/home/indfinitydesign/public_html/img/photos/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:41:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45493: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:43:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57882: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 16:43:21 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 16:43:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57882: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.53.110.66
country_id: 1733045
description:
[2026-01-13 16:44:15 +0800] info [webmaild] 60.53.110.66 - muslihin@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.49
country_id: 690791
description:
Jan 13 16:45:15 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.10.196.106
country_id: 3469034
description:
Jan 13 16:47:44 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.10.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.246.73.51
country_id: 3277605
description:
Jan 13 16:47:14 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.246.73.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.142
country_id: 798544
description:
Jan 13 16:47:20 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.196
country_id: 298795
description:
Jan 13 16:48:45 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/img/photos/press.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.249.184
country_id: 3865483
description:
Jan 13 16:49:37 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.249.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.189
country_id: 3469034
description:
Jan 13 16:49:09 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/druma/private-residence.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.41
country_id: 3175395
description:
Jan 13 16:49:35 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 16:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60200: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.80.106
country_id: 1512440
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/drop/602/523449 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 16:51:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60202: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 61.6.237.57
country_id: 1820814
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/fzaninotto/faker/phpunit.xml.dist HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.14.191.140
country_id: 6252001
domain: 34.217.47.154
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.47.154/azenv5.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.65
country_id: 3865483
description:
Jan 13 16:53:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 16:54:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55767: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 16:54:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55768: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.138.92.142
country_id: 1733045
description:
[2026-01-13 16:54:36 +0800] info [webmaild] 175.138.92.142 - admin@saps.com.my "GET /cpsess0430047522/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.90
country_id: 3175395
description:
Jan 13 16:56:38 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 210.186.147.145
country_id: 1733045
domain: www.cordage.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:(select (case when (2013=8803) then 621977 else (select 8803 union select 5281) end))||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 203.80.23.190
country_id: 1733045
domain: www.cordage.com.my
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:sqlmap/1.8.4#stable (https://sqlmap.org)||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 203.80.23.190
country_id: 1733045
domain: www.cordage.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:621977) and extractvalue(1372,concat(0x5c,0x71786a6a71,(select (elt(1372=1372,1))),0x7178786271)) and (5977=5977||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.77.63.53
country_id: 1562822
description:
2026-01-13 16:59:33 dovecot_login authenticator failed for H=(213.5.130.181) [27.77.63.53]:50580: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.39.157.60
country_id: 1814991
description:
2026-01-13 16:59:52 dovecot_login authenticator failed for H=(190.2.145.188) [125.39.157.60]:53623: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.223
country_id: 1733045
description:
[2026-01-13 16:59:21 +0800] info [webmaild] 27.125.240.223 - celynnloh@mckd.com.my "POST /cpsess8706877058/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.240.82] != Current IP Address [27.125.240.223]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.244.192.175
country_id: 953987
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/park/13/502/1342511 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.208.201.118
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/comparator/tests/_fixture HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.192.68
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/comparator/tests/_fixture/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.43.133.50
country_id: 2658434
description:
Jan 13 17:05:27 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.43.133.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.43.133.50
country_id: 2658434
description:
2026-01-13 17:05:29 dovecot_login authenticator failed for H=(190.2.145.187) [179.43.133.50]:60682: 535 Incorrect authentication data (set_id=mdnaser@grandteknik.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.247.141
country_id: 933860
description:
Jan 13 17:05:26 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.247.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.218.233
country_id: 3469034
description:
Jan 13 17:06:38 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.218.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.8.240.44
country_id: 2017370
description:
Jan 13 17:07:01 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.8.240.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2026-01-13 17:07:03 dovecot_login authenticator failed for H=([46.8.240.44]) [46.8.240.44]:38988: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.214.251.16
country_id: 6252001
description:
2026-01-13 17:07:08 dovecot_login authenticator failed for H=76-214-251-16.lightspeed.livnmi.sbcglobal.net ([127.0.0.1]) [76.214.251.16]:52424: 535 Incorrect authentication data (set_id=info@webhosting2u.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.22
country_id: 3175395
description:
Jan 13 17:06:18 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:09:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45503: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:09:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:45504: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.133
country_id: 3469034
description:
Jan 13 17:09:41 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57892: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.176
country_id: 3469034
description:
Jan 13 17:11:09 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:11:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57893: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.117.175
country_id: 798544
description:
Jan 13 17:11:35 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.117.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.203.65
country_id: 6252001
description:
[2026-01-13 17:12:38 +0800] info [whostmgrd] 156.239.203.65 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.129.19.25
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/mtdowling/cron-expression/tests/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/keyword/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.34.23.58
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/mtdowling/cron-expression/tests HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.53.3
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/debug/phpunit.xml.dist HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2026-01-13 17:15:59 dovecot_login authenticator failed for H=([111.50.70.34]) [111.50.70.34]:57601: 535 Incorrect authentication data (set_id=prayerlink)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
country_id: 1814991
description:
Jan 13 17:15:57 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.165.221.113
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/listen/8/818426 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
country_id: 1814991
description:
Jan 13 17:15:42 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
country_id: 1814991
description:
2026-01-13 17:15:44 dovecot_login authenticator failed for H=([111.61.176.243]) [111.61.176.243]:24268: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.158
country_id: 3865483
description:
Jan 13 17:15:56 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.158
country_id: 3865483
description:
Jan 13 17:16:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/img/photos/testimonial.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 17:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60237: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
country_id: 1814991
description:
Jan 13 17:19:52 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2026-01-13 17:19:54 dovecot_login authenticator failed for H=([60.173.105.206]) [60.173.105.206]:38407: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 17:19:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60238: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"text-decoration: underline;\"><strong>tuesday 13-jan-26</strong></span></p>\r\n<ul>\r\n<li>update tsb container arrival worksheet.</li>\r\n<li>follow up all havens container eta port klang with liner.</li>\r\n<li>preparing si for farnam order.</li>\r\n<li>follow up with kk on booking shipment for malaysia order.</li>\r\n<li>provide information to kk(sha) for philippines order.</li>\r\n<li>checking with mr anuar on warehouse availability to arrange export and import containner.</li>\r\n<li>demeter container released but no space at the moment in warehouse, re-arrange to come in by 15-jan-26.</li>\r\n<li>provide ip to supplier</li>\r\n<li>checking k1 draft and preparing loi</li>\r\n<li>follow up and remind greenpen for export shipment t o manila</li>\r\n<li>preparing draft documentation for philippines order.</li>\r\n<li>update tpy import schedule.</li>\r\n<li>monitor on us consol arrangement.</li>\r\n<li>preparing shipping document for clearance.</li>\r\n<li>pass shipping documents to jess for posting.</li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.97.227
country_id: 6290252
description:
Jan 13 17:21:19 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.97.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.254.134
country_id: 3469034
description:
Jan 13 17:21:39 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.254.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 17:22:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56015: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.152.114
country_id: 3996063
description:
Jan 13 17:22:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.152.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.115
country_id: 3175395
description:
Jan 13 17:22:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.161.144
country_id: 6252001
description:
Jan 13 17:23:04 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.161.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-01-13 17:23:06 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (proveric) [73.199.161.144]:56410: 535 Incorrect authentication data (set_id=charles.loo@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.187
country_id: 1269750
description:
Jan 13 17:24:17 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.120.90
country_id: 3469034
description:
Jan 13 17:24:29 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.120.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.107.136.187
country_id: 690791
description:
2026-01-13 17:24:44 dovecot_plain authenticator failed for H=(unplic) [185.107.136.187]:53518: 535 Incorrect authentication data (set_id=peinee.seh@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.212.251.31
country_id: 690791
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/tests/values HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">print out supplies invoice and statement in email</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin supplies invoice - purchase invoices in software</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">payment to supplies and staff claim (do bank transfer-pending for approval) 13/1/26</li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.24.159.180
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/tests/values/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-13 17:24:31 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:46483: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.107.136.187
country_id: 690791
description:
Jan 13 17:24:42 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.107.136.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.107.136.187
country_id: 690791
description:
Jan 13 17:25:20 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.107.136.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.107.136.187
country_id: 690791
description:
2026-01-13 17:25:22 dovecot_plain authenticator failed for H=(juncalla) [185.107.136.187]:54761: 535 Incorrect authentication data (set_id=siowchi.kwang@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.108
country_id: 298795
description:
Jan 13 17:27:00 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.108
country_id: 298795
description:
Jan 13 17:27:13 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.92.249
country_id: 1168579
description:
Jan 13 17:27:37 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.92.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-13 17:27:39 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:50226: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.120.90
country_id: 3469034
description:
Jan 13 17:28:38 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.120.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-13 17:28:40 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:52931: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
country_id: 2017370
description:
2026-01-13 17:29:36 dovecot_plain authenticator failed for H=(clarin) [5.167.48.130]:42753: 535 Incorrect authentication data (set_id=sales@euratech.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.200.207
country_id: 6252001
description:
[2026-01-13 17:29:37 +0800] info [whostmgrd] 156.239.200.207 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.50.224.53
country_id: 3865483
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but02.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.238.254.187
country_id: 3469034
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/spacer.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.181.246.36
country_id: 3865483
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/top.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.113.188.233
country_id: 3865483
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/bg_but.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.148.103.14
country_id: 1210997
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but01.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.221.211
country_id: 1562822
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but04.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.133.140.105
country_id: 1210997
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/pix_main02.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.168.49
country_id: 1562822
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but05.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.152.87.227
country_id: 3469034
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/bg.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.65.234
country_id: 3865483
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/pix_main01.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.25.83.98
country_id: 690791
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/sider.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.232.113.43
country_id: 357994
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.191.123.79
country_id: 1168579
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/logo.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.102.125
country_id: 3625428
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but_top.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.141.151.205
country_id: 3865483
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/but03.gif HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.245.104.4
country_id: 3996063
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/images/pix_main.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.202
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/anaconda/packaging.log||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.228.206
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=503368 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.4
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/anaconda/storage.log||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dovecot/dovecot.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.51
country_id: 3175395
description:
Jan 13 17:37:00 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:37:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:46071: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.135
country_id: 2300660
description:
Jan 13 17:37:20 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/survey-meter/images/sliders/survey-meter.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:37:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:46071: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.51
country_id: 3175395
description:
Jan 13 17:37:13 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.51 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:39:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57900: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.137.8
country_id: 1733045
description:
2026-01-13 17:39:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.137.8]:57900: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.150
country_id: 933860
description:
Jan 13 17:40:32 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.47.243.8
country_id: 357994
description:
Jan 13 17:40:52 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.47.243.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.47.243.8
country_id: 357994
description:
2026-01-13 17:40:54 dovecot_plain authenticator failed for H=(bonplated) [197.47.243.8]:52728: 535 Incorrect authentication data (set_id=contact@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.144
country_id: 3469034
description:
Jan 13 17:40:10 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.84
country_id: 3175395
description:
Jan 13 17:43:05 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.202
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/pipewire.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.33
country_id: 3175395
description:
Jan 13 17:42:34 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.236
country_id: 3469034
description:
Jan 13 17:43:25 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.84
country_id: 3175395
description:
Jan 13 17:43:12 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.47.243.8
country_id: 357994
description:
Jan 13 17:44:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.47.243.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 13 17:44:49 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.47.243.8
country_id: 357994
description:
2026-01-13 17:44:13 dovecot_plain authenticator failed for H=(disills) [197.47.243.8]:52400: 535 Incorrect authentication data (set_id=webmaster@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.100.158
country_id: 3996063
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/loreal/division-beaute-dermatologique/skinceuticals/index.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 17:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60297: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 17:47:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60297: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.127
country_id: 597427
description:
2026-01-13 17:48:26 H=([141.98.10.127]) [141.98.10.127]:61453 F=<customer_support@epson.co.kr> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.211.214.240
country_id: 1733045
description:
2026-01-13 17:48:48 H=([192.168.1.38]) [113.211.214.240]:7913 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<vasundra@egbwawasan.com.my> A=dovecot_login:vasundra@egbwawasan.com.my temporarily rejected RCPT <SweatLing.Kor@kerrylogistics.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 17:50:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56137: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 17:50:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56137: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.136.115.209
country_id: 2510769
description:
Jan 13 17:50:55 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.136.115.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.136.115.209
country_id: 2510769
description:
Jan 13 17:51:08 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.136.115.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.45
country_id: 3865483
description:
Jan 13 17:51:15 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.45 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.171.53.74
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/application/themes/bishop/images/drag-to-explore-icon.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 213.230.107.111
country_id: 1512440
description:
2026-01-13 17:54:58 2535827 [Warning] Aborted connection 2535827 to db: 'unconnected' user: 'unauthenticated' host: '213.230.107.111' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.73.163.225
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/images/casual.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.138.101
country_id: 587116
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/application/js/smooth.scroll.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.221.252.181
country_id: 783754
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/images/cafe.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 142.154.87.163
country_id: 102358
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/images/foodcourt.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.182.150.54
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.204.209.58
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/images/logoo-cabee.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.73.15.120
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/concrete/js/jquery.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.15.168.196
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/images/fastfood.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.36.30.160
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/application/js/all.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140852
name: IM360 WAF: SQL Dorks collection for SQL Injection
abuser: 174.116.38.10
country_id: 6251999
domain: www.nobledec.com
description:
IM360 WAF: SQL Dorks collection for SQL Injection||MVN:ARGS:id||RSV:7.62||T:APACHE||MV:30,.\"'(,,,,.||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.159.192
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/polyfill-util/TestListenerTrait.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 174.116.38.10
country_id: 6251999
domain: www.nobledec.com
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:sqlmap/1.9.11#pip (https://sqlmap.org)||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 17:57:55 H=([77.83.39.92]) [77.83.39.92]:52479 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <astpkg@astlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.84
country_id: 2510769
description:
Jan 13 17:57:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.9
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/apache2.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.10
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/systemd.conf||User:root||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>posted assembly orders</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>learn with ms.kho how to do bank reconciliation for december 2025</li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.10
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/lvm2.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.51.118.218
country_id: 3469034
description:
Jan 13 18:00:39 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.51.118.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.29
country_id: 298795
description:
Jan 13 18:01:05 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.29
country_id: 298795
description:
Jan 13 18:01:13 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.166
country_id: 3865483
description:
Jan 13 18:02:01 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.14.123
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-01.168.91.14.123||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.166
country_id: 3865483
description:
Jan 13 18:02:09 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-13 18:05:52 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (prows) [174.169.224.27]:50228: 535 Incorrect authentication data (set_id=webmaster@fkr.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 18:06:01 H=([77.83.39.92]) [77.83.39.92]:55221 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <celine@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.169.224.27
country_id: 6252001
description:
Jan 13 18:05:50 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.169.224.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 18:08:00 H=([77.83.39.92]) [77.83.39.92]:60081 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 174.138.80.231
country_id: 6252001
description:
2026-01-13 18:08:35 2536428 [Warning] Aborted connection 2536428 to db: 'unconnected' user: 'unauthenticated' host: '174.138.80.231' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.210.177.189
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-11.192.210.177.189||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 18:11:44 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.59.87
country_id: 1269750
description:
Jan 13 18:11:51 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.59.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.59.87
country_id: 1269750
description:
2026-01-13 18:11:53 dovecot_login authenticator failed for H=(abts-north-static-087.59.160.122.airtelbroadband.in) [122.160.59.87]:39502: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-13 18:12:27 H=([185.214.10.21]) [185.214.10.21]:64155 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@aircarbonic.my> rejected RCPT <info@aircarbonic.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 18:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60357: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 18:15:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60358: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.114.21.51
country_id: 2328926
description:
Jan 13 18:16:25 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.114.21.51 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.111.0
country_id: 1733045
description:
[2026-01-13 18:16:59 +0800] info [webmaild] 113.211.111.0 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 18:16:17 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.185.243.157
country_id: 3469034
description:
2026-01-13 18:16:26 dovecot_login authenticator failed for H=177-185-243-157.goxinternet.com.br (213.5.130.102) [177.185.243.157]:41670: 535 Incorrect authentication data (set_id=syazwani@sanicarehygiene.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2026-01-13 18:16:27 dovecot_plain authenticator failed for H=(ducks) [105.114.21.51]:52509: 535 Incorrect authentication data (set_id=support@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.23.182.16
country_id: 2017370
description:
Jan 13 18:17:10 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.23.182.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 18:18:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56219: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.23.182.16
country_id: 2017370
description:
2026-01-13 18:17:12 dovecot_login authenticator failed for H=([81.23.182.16]) [81.23.182.16]:55418: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 18:18:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56219: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.41.156.64
country_id: 2017370
description:
Jan 13 18:19:01 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.41.156.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.41.156.64
country_id: 2017370
description:
2026-01-13 18:19:03 dovecot_login authenticator failed for H=([77.41.156.64]) [77.41.156.64]:58812: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-13 18:23:29 H=([45.144.212.54]) [45.144.212.54]:63408 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/company.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-13 18:25:34 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:41717: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-13 18:26:31 H=([185.214.10.21]) [185.214.10.21]:60788 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@aircarbonic.my> rejected RCPT <info@aircarbonic.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.113.156
country_id: 3057568
description:
Jan 13 18:28:40 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.113.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 18:30:46 H=([77.83.39.92]) [77.83.39.92]:63797 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <inquiries@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 18:31:17 H=([77.83.39.92]) [77.83.39.92]:63038 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <jacklim@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/survey-meter.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.206.33.121
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/library/348/64467 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.30.189
country_id: 1819730
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/trophy-4.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 49.228.196.191
country_id: 1605651
description:
2026-01-13 18:36:37 2537704 [Warning] Aborted connection 2537704 to db: 'unconnected' user: 'unauthenticated' host: '49.228.196.191' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.143.248.66
country_id: 3617476
description:
2026-01-13 18:37:36 dovecot_login authenticator failed for H=(213.5.130.104) [190.143.248.66]:45112: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.189
country_id: 6252001
description:
2026-01-13 18:38:31 dovecot_plain authenticator failed for H=([10.27.18.187]) [91.124.17.189]:44995: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.189
country_id: 6252001
description:
2026-01-13 18:39:10 dovecot_login authenticator failed for H=([10.27.18.187]) [91.124.17.189]:1094: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 18:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60402: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 18:43:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60402: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-13 18:44:15 H=([45.144.212.54]) [45.144.212.54]:56030 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 18:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51581: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.222.94
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/Tests/Exception HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.77.16.141
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/Tests/Exception/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 18:46:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51581: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.199
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/responsive.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.36.163.2
country_id: 286963
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/?page_id=5 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.242
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/plugins/revolution/css/settings.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.152.154.140
country_id: 3469034
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/?page_id=5 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.243
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/css/custom.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.222
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.indfinitydesign.com/css/bootstrap.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/plugins/revolution/css/navigation.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.221.50.37
country_id: 953987
description:
Jan 13 18:52:46 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.221.50.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.188
country_id: 3469034
description:
Jan 13 18:53:19 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.23
country_id: 2750405
description:
Jan 13 18:54:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.24
country_id: 2750405
description:
Jan 13 18:54:54 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.16
country_id: 2750405
description:
Jan 13 18:54:54 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.13
country_id: 2750405
description:
Jan 13 18:54:55 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 18:54:18 H=([77.83.39.92]) [77.83.39.92]:50697 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.12
country_id: 2750405
description:
Jan 13 18:54:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.15
country_id: 2750405
description:
Jan 13 18:54:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.20
country_id: 2750405
description:
Jan 13 18:54:54 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.17
country_id: 2750405
description:
Jan 13 18:54:54 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.19
country_id: 2750405
description:
Jan 13 18:54:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.21
country_id: 2750405
description:
Jan 13 18:54:54 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.154
country_id: 3865483
description:
Jan 13 18:56:33 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.88.112
country_id: 3469034
description:
Jan 13 18:58:09 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.88.112 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.186
country_id: 3175395
description:
Jan 13 19:02:45 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.2
country_id: 732800
description:
Jan 13 19:03:04 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.2
country_id: 732800
description:
Jan 13 19:03:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul style=\"margin-top: 0in;\" type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up final bl from tvs for sejoong order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up final coo from kk for sejoong order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up cargo pictures from scf for hkjc order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send shipping documents to hkjc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send shipping documents to sejoong.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send pre alert import docs to hk awards.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up draft docs from whitby.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send weekly report to hkjc.</span></li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-13 19:07:24 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:50874: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.125.52.158
country_id: 2510769
description:
Jan 13 19:07:57 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.125.52.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.170.251.33
country_id: 2017370
description:
Jan 13 19:07:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.170.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2026-01-13 19:08:39 dovecot_login authenticator failed for H=([102.88.10.10]) [102.88.10.10]:47512: 535 Incorrect authentication data (set_id=kimmarkpurchase@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
country_id: 1819730
description:
Jan 13 19:08:17 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-13 19:08:19 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:58282: 535 Incorrect authentication data (set_id=serene.chin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.88.10.10
country_id: 2328926
description:
Jan 13 19:08:37 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.88.10.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
country_id: 290557
description:
Jan 13 19:08:45 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-13 19:08:47 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:48468: 535 Incorrect authentication data (set_id=kimmarkpurchase@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.125.52.158
country_id: 2510769
description:
Jan 13 19:08:10 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.125.52.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
country_id: 1814991
description:
Jan 13 19:09:22 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-01-13 19:09:24 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:26012: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2026-01-13 19:10:32 dovecot_login authenticator failed for H=([111.61.177.187]) [111.61.177.187]:32828: 535 Incorrect authentication data (set_id=chew)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 19:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60430: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
country_id: 1814991
description:
Jan 13 19:10:30 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 19:11:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60430: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.208.81.125
country_id: 6252001
description:
Jan 13 19:13:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.208.81.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
country_id: 290557
description:
Jan 13 19:13:37 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-13 19:13:39 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:40640: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-01-13 19:13:50 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:43037: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.85.144
country_id: 1269750
description:
Jan 13 19:13:48 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.85.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-13 19:13:55 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (excle) [73.208.81.125]:60962: 535 Incorrect authentication data (set_id=fazrul.fahmee@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 19:14:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57956: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 19:14:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57956: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.184
country_id: 2635167
description:
Jan 13 19:14:19 sv3 pure-ftpd[933833]: (?@185.247.137.184) [INFO] New connection from 185.247.137.184


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.183.93.32
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-14.93.183.93.32||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 136.169.236.55
country_id: 2017370
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:19-17.136.169.236.55||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.144.246.95
country_id: 798544
description:
Jan 13 19:19:06 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.144.246.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.111.91.69
country_id: 690791
description:
Jan 13 19:18:38 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 86.111.91.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-01-13 19:18:40 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:54225: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.210.57
country_id: 798544
description:
Jan 13 19:18:53 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.210.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.144.246.95
country_id: 798544
description:
Jan 13 19:19:13 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.144.246.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.9
country_id: 1269750
description:
Jan 13 19:19:25 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.7.187.138
country_id: 3469034
description:
Jan 13 19:20:40 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.7.187.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.208.81.125
country_id: 6252001
description:
Jan 13 19:20:24 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.208.81.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-13 19:20:26 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (piantrion) [73.208.81.125]:33936: 535 Incorrect authentication data (set_id=info@kimmark.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.62.211.15
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-21.158.62.211.15||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.41
country_id: 3175395
description:
Jan 13 19:21:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.227
country_id: 3865483
description:
Jan 13 19:21:11 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.36
country_id: 798544
description:
Jan 13 19:24:00 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/news.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.36
country_id: 798544
description:
Jan 13 19:24:13 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.112.186
country_id: 732800
description:
Jan 13 19:24:19 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.112.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.163.38.102
country_id: 3077311
description:
Jan 13 19:25:16 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.163.38.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.246
country_id: 690791
description:
Jan 13 19:25:35 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.208.81.125
country_id: 6252001
description:
Jan 13 19:27:50 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.208.81.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-13 19:27:52 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (bented) [73.208.81.125]:59538: 535 Incorrect authentication data (set_id=sabi@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.145
country_id: 1269750
description:
Jan 13 19:28:42 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.250.111
country_id: 3469034
description:
Jan 13 19:28:27 sv3 auth[739871]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.250.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/login.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.224
country_id: 3175395
description:
Jan 13 19:33:30 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.224 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/contact.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.41.175.52
country_id: 798544
description:
Jan 13 19:33:48 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.41.175.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.60.66
country_id: 1819730
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/assets/images/logooo.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 19:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60455: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.114.151.204
country_id: 953987
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/logos/logo.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.105.81.227
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/js/bxslider/images/bx_loader.gif HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.74.11.107
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/about-photo.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.139.63.42
country_id: 248816
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/testimonials/liquid.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.126.47
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/testimonials/dirt.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.32.32.169
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/chair.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.154.209
country_id: 99237
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/bg4324.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 19:39:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60456: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.16.98
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/banner3.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.230.205.230
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/sofa.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.15.230.46
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/testimonials/dust.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.152.141
country_id: 99237
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/blog/tensile.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.12.121.68
country_id: 1168579
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/bedheadband.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.235.235.31
country_id: 1269750
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/backgrounds/arrow-2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.237.164.144
country_id: 192950
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/hair.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.222.113.249
country_id: 3923057
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/bg42341.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.13.193.100
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/wrinkle.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.27.75.25
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/blog/flex.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.49.33
country_id: 192950
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.0.7.238
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/veins.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.93.226.226
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/blog/tear.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.2.100.248
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/rs-plugin/css/layers.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.135.39
country_id: 2635167
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/googlemap2.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.175.45.64
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/rs-plugin/js/jquery.themepunch.tools.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.77.72.215
country_id: 1269750
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/scars.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.123.241.187
country_id: 1269750
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/rs-plugin/js/jquery.themepunch.revolution.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.71.186
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/jquery/jquery.min.js HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.204.141.22
country_id: 1210997
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/banner2.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.13.113.180
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/banner4.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.141.192
country_id: 587116
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/insect_bites.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.208.243.180
country_id: 3469034
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/banner1.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.180.222.34
country_id: 99237
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/waze.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.60.130
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.110.193
country_id: 798544
description:
Jan 13 19:41:07 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.110.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.199
country_id: 3175395
description:
Jan 13 19:41:10 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.110.193
country_id: 798544
description:
Jan 13 19:41:14 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.110.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.97
country_id: 3175395
description:
Jan 13 19:41:53 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.123
country_id: 2077456
domain: acburn.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:acburnco||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.106
country_id: 2077456
domain: indfinitydesign.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:indfinitydesign||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.219.125
country_id: 3865483
description:
Jan 13 19:41:09 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.219.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 111.225.148.36
country_id: 1814991
domain: www.box.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.123
country_id: 2077456
domain: ajplantations.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:ajpl3424||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 19:42:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58015: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.115.191
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=735818 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.126
country_id: 2077456
domain: ajresorts.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:ajresortscom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.123
country_id: 2077456
domain: nmahir.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:nmahirc||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.99.20
country_id: 3996063
description:
Jan 13 19:41:28 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.99.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.114
country_id: 2077456
domain: urban.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:urban||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.116
country_id: 2077456
domain: mkmetal.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:mkmetalc||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.176
country_id: 3469034
description:
Jan 13 19:41:46 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.176 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.153
country_id: 2077456
domain: smartcable.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:smartcable||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.124
country_id: 2077456
domain: aircarbonic.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:aircarbonicadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.116
country_id: 2077456
domain: symphony-led.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:symphonyadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.122
country_id: 2077456
domain: lnlfireprotection.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:lnlfireprotectio||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.136
country_id: 2077456
domain: pspoly.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:pspolycom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 19:42:12 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58015: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.107
country_id: 2077456
domain: modern.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:modern||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.120
country_id: 2077456
domain: ms-chemicals.net
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:mschemic||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.144
country_id: 2077456
domain: eminent.st
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:eminent||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.148
country_id: 2077456
domain: vtgroupsb.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:vtgroupsb||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.149
country_id: 2077456
domain: langkawiconstructions.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:lkwconstructions||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.160
country_id: 2077456
domain: imax.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:imaxcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.125
country_id: 2077456
domain: empirelog.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:empi7862||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.128
country_id: 2077456
domain: stillman.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:stillman||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.139
country_id: 2077456
domain: box.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:woh||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.118
country_id: 2077456
domain: sutsb.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:sutsbcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.137
country_id: 2077456
domain: stonewld.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:stonewld||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.154
country_id: 2077456
domain: mokshana.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:mokshanacom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.124
country_id: 2077456
domain: aire-fresh.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:airefresh||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.135
country_id: 2077456
domain: evergrown.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:evergrown||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.110
country_id: 2077456
domain: agpc.org.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:agpcorg||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.113
country_id: 2077456
domain: agsaintifik.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:agsaintifik||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.115
country_id: 2077456
domain: egbwawasan.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:egbwawasancom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.140
country_id: 2077456
domain: nexuscollection.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:nexus2019||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.151
country_id: 2077456
domain: af-sb.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:afsb||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.109
country_id: 2077456
domain: rcct.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:rcct||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.137
country_id: 2077456
domain: myfurnitureshop.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:myfurnit||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.149
country_id: 2077456
domain: ahfengineering.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:ahfe3522||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.124
country_id: 2077456
domain: www.inter-link.edu.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:interlink||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.110
country_id: 2077456
domain: fkr.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:fkrcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.128
country_id: 2077456
domain: fimco.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:fimco||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.161
country_id: 2077456
domain: chs.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:chscommy||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.117
country_id: 2077456
domain: masaakisb.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:masaakisb||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.138
country_id: 2077456
domain: saps.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:sapscom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.118
country_id: 2077456
domain: cordage.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:admincordage||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.122
country_id: 2077456
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:pftfood||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.154
country_id: 2077456
domain: manforce.net
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:manfotp3||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.149
country_id: 2077456
domain: feliogroup.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:feliogroupcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.115
country_id: 2077456
domain: tst-ma.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:tstmacom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.113
country_id: 2077456
domain: advisorygroup.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:advi3535||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.112
country_id: 2077456
domain: lvconsult.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:lvconsultcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.138
country_id: 2077456
domain: aoto.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:aotocom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.131
country_id: 2077456
domain: hmz.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:hmzcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.137
country_id: 2077456
domain: autogreastar.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:autogrea||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.145
country_id: 2077456
domain: oxbold.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:oxboldc||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.149
country_id: 2077456
domain: vmsmotorsports.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:vmsadmin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.123
country_id: 2077456
domain: garudabay.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:garudabay||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.107
country_id: 2077456
domain: jpack.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:jpackcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.141
country_id: 2077456
domain: achieversvisionacademy.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:achieversvisiona||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.122
country_id: 2077456
domain: nobledec.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:nobledec||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.134
country_id: 2077456
domain: astlog.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:astlogc||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.113
country_id: 2077456
domain: visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:visoftcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.145
country_id: 2077456
domain: tujusetia.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:tuju7822||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.130
country_id: 2077456
domain: mckd.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:mckd||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.130
country_id: 2077456
domain: webhosting2u.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:webhost||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.115
country_id: 2077456
domain: euratech.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:euratechcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.116.101
country_id: 3469034
description:
Jan 13 19:47:23 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.116.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.145.240.127
country_id: 6252001
domain: mail.printspecsolution.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.63||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.35
country_id: 3175395
description:
Jan 13 19:50:36 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.208.171
country_id: 798544
description:
Jan 13 19:50:54 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.208.171 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.96.246.66
country_id: 290557
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603677 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.48.70.30
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=144058 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.103.119.166
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=25 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.228.38.220
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=553758 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.208.141.241
country_id: 2245662
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&page_id=1&sub=2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.47.40.68
country_id: 357994
description:
Jan 13 20:03:00 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.47.40.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.47.40.68
country_id: 357994
description:
2026-01-13 20:03:02 dovecot_plain authenticator failed for H=(unattengum) [197.47.40.68]:47548: 535 Incorrect authentication data (set_id=mail@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.142
country_id: 1269750
description:
Jan 13 20:03:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.45.167.104
country_id: 2510769
description:
Jan 13 20:03:41 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.45.167.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 20:03:59 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.193.153.67
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=515102 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.109
country_id: 2077456
domain: printspecsolution.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:printspecsolutio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.126
country_id: 2300660
description:
Jan 13 20:05:48 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.111
country_id: 2077456
domain: dsc-expat.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:dscexpat||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.127
country_id: 2077456
domain: maalloys.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:maalloyscom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.109
country_id: 2077456
domain: geminiflourmill.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:cabecom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.142
country_id: 2077456
domain: tschuan.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:tschuan||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.144
country_id: 2077456
domain: cofreth.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:cofrethcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.122
country_id: 2077456
domain: gagasanteguh.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:gagasanteguhcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.109
country_id: 2077456
domain: dps-comsec.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:dpscomsec||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.115
country_id: 2077456
domain: kimmark.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:kimmark||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.129
country_id: 2077456
domain: dynamic-hr.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:dynamichrcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.141
country_id: 2077456
domain: kendek.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:kendek||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.125
country_id: 2077456
domain: kdiballoon.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:kdiballo1||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.114
country_id: 2077456
domain: vc-b.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:vcbcom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.133
country_id: 2077456
domain: ds-staffing.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:dsstaffing||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.125
country_id: 2077456
domain: solidfence.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:solidfencecom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.133.5.106
country_id: 2077456
domain: krisfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:krisfood||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-13 20:06:42 H=([62.60.130.227]) [62.60.130.227]:53277 F=<noreply@apix.fi> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from apix.fi


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 20:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60474: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 20:07:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60474: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.91
country_id: 3865483
description:
Jan 13 20:07:33 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.55
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/81.0.4044.92 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 20:08:31 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.72.193.120
country_id: 1643084
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=3 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/apm/images/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 20:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58118: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 20:10:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58118: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.216
country_id: 3175395
description:
Jan 13 20:12:21 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.139.92
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=486189 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.1.175.182
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=20 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
country_id: 1814991
description:
Jan 13 20:14:38 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2026-01-13 20:14:40 dovecot_login authenticator failed for H=([218.22.187.70]) [218.22.187.66]:49058: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.17.126
country_id: 798549
description:
2026-01-13 20:18:08 dovecot_plain authenticator failed for H=(no-rdns.mivocloud.com) [185.225.17.126]:35412: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.17.126
country_id: 798549
description:
2026-01-13 20:18:13 dovecot_plain authenticator failed for H=(no-rdns.mivocloud.com) [185.225.17.126]:35426: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.133
country_id: 2510769
description:
Jan 13 20:19:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.133 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 188.126.94.74
country_id: 2623032
domain: box.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.242
country_id: 3175395
description:
Jan 13 20:19:32 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 20:20:54 H=([77.83.39.92]) [77.83.39.92]:52173 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <jaya@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.48.223.159
country_id: 1733045
description:
2026-01-13 20:21:19 H=([192.168.68.103]) [60.48.223.159]:51157 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<vasundra@egbwawasan.com.my> A=dovecot_login:vasundra@egbwawasan.com.my temporarily rejected RCPT <SweatLing.Kor@kerrylogistics.com>: host lookup did not complete


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.132.252
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=541552 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.109.99.59
country_id: 660013
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-22.65.109.99.59||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/news.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.189.184.17
country_id: 1227603
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=449403 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/demos/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.160.21
country_id: 2542007
description:
2026-01-13 20:27:46 dovecot_plain authenticator failed for H=([192.168.1.8]) [196.75.160.21]:58608: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2026-01-13 20:30:30 dovecot_login authenticator failed for H=([123.129.245.249]) [123.129.245.249]:49317: 535 Incorrect authentication data (set_id=jobs@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.160.21
country_id: 2542007
description:
2026-01-13 20:31:08 dovecot_plain authenticator failed for H=([192.168.1.8]) [196.75.160.21]:57819: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
country_id: 1814991
description:
Jan 13 20:30:28 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.75.160.21
country_id: 2542007
description:
2026-01-13 20:31:12 dovecot_plain authenticator failed for H=([192.168.1.8]) [196.75.160.21]:57823: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 196.75.160.21
country_id: 2542007
description:
2026-01-13 20:31:19 dovecot_login authenticator failed for H=([192.168.1.8]) [196.75.160.21]:58591: 535 Incorrect authentication data (set_id=rafidah@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.193.26.55
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=708804 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.179.38.132
country_id: 2017370
description:
2026-01-13 20:34:42 dovecot_plain authenticator failed for H=(diple) [82.179.38.132]:33047: 535 Incorrect authentication data (set_id=support@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 20:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60505: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 20:35:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60506: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.235.54.243
country_id: 357994
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=227277 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.6
country_id: 1149361
description:
Jan 13 20:38:00 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2026-01-13 20:38:02 dovecot_login authenticator failed for H=([149.54.15.6]) [149.54.15.6]:42843: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 20:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58196: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.73.51.218
country_id: 1814991
description:
Jan 13 20:38:23 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.73.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.73.51.218
country_id: 1814991
description:
2026-01-13 20:38:25 dovecot_login authenticator failed for H=([222.73.51.218]) [222.73.51.218]:40480: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-13 20:38:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58196: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.97
country_id: 798544
description:
Jan 13 20:39:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.160
country_id: 3469034
description:
Jan 13 20:39:29 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.160 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.150.246.136
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=954784 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.186.98
country_id: 6252001
description:
[2026-01-13 20:41:32 +0800] info [cpaneld] 136.227.186.98 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.238
country_id: 3865483
description:
Jan 13 20:41:39 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 151.240.205.206
country_id: 6252001
domain: aoto.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/89.0.4389.90 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.208.54
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=611667 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/photos/services.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.124.249.36
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=263428 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-13 20:44:10 H=([77.83.39.92]) [77.83.39.92]:61020 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <stacy@ktlog.com.my>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/iso.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.221
country_id: 3865483
description:
Jan 13 20:45:54 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.53
country_id: 690791
description:
Jan 13 20:45:33 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.53 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.203.142.115
country_id: 690791
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/tests/Bootstrap.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.221
country_id: 3865483
description:
Jan 13 20:46:09 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.179.38.132
country_id: 2017370
description:
Jan 13 20:47:36 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.179.38.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.179.38.132
country_id: 2017370
description:
2026-01-13 20:47:38 dovecot_plain authenticator failed for H=(ortal) [82.179.38.132]:38116: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.49.36.17
country_id: 6252001
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /contact.php?companyaddress=Hi Team,\r\n\r\nI spotted your site is stuck on Page 2 of Google for your main keywords.\r\n\r\nHonestly, your site looks better than the competitors ranking #1, yet they are getting the market share. You are essentially donating leads to them for free because of hidden technical issues.\r\n\r\nI have generated a comparison report pinpointing how to fix this.\r\n\r\nReply with \"yes\" and I'll send it over.\r\n\r\nCheers,\r\nP Media Partners&message=Hi Team,\r\n\r\nI spotted your website is hanging on the second page of Google for high-traffic search terms.\r\n\r\nFrankly, your site looks superior than the guys at the top, yet they are getting all the traffic. You are essentially donating customers to them on a silver platter due to hidden technical issues.\r\n\r\nI have generated a competitor analysis showing exactly how to beat them.\r\n\r\nSimply reply \"yes\" and I'll email it to you.\r\n\r\nRegards,\r\nP Media Partners HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.101.144
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=186475 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 157.230.43.225
country_id: 1880251
domain: inter-link.edu.my
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:-d allow_url_include=on -d auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/demos/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.50.204.222
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=731605 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.218
country_id: 1269750
description:
Jan 13 20:54:45 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-13 20:56:15 H=([185.214.10.21]) [185.214.10.21]:54215 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@mkmetal.com.my> rejected RCPT <info@mkmetal.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.183.119
country_id: 3865483
description:
Jan 13 20:57:49 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.183.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.95.2.65
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=678166 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.98
country_id: 226074
description:
Jan 13 20:57:27 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 14.192.213.164
country_id: 1733045
description:
[2026-01-13 20:59:40 +0800] info [webmaild] 14.192.213.164 - jefflee@sutsb.com.my "POST /cpsess1641748787/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.53.110.66] != Current IP Address [14.192.213.164]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.92.59
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=11 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.127.33.159
country_id: 3469034
description:
Jan 13 21:01:03 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.127.33.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.119.182.79
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-01.92.119.182.79||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.127.33.159
country_id: 3469034
description:
Jan 13 21:01:11 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.127.33.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:03:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60527: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:03:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60527: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 196.251.100.206
country_id: 241170
description:
2026-01-13 21:05:45 2544608 [Warning] Aborted connection 2544608 to db: 'unconnected' user: 'unauthenticated' host: '196.251.100.206' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.173.18.250
country_id: 1814991
description:
Jan 13 21:06:37 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.173.18.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.173.18.250
country_id: 1814991
description:
2026-01-13 21:06:39 dovecot_login authenticator failed for H=([117.173.18.250]) [117.173.18.250]:59096: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 196.251.100.206
country_id: 241170
description:
2026-01-13 21:07:41 2544707 [Warning] Aborted connection 2544707 to db: 'unconnected' user: 'unauthenticated' host: '196.251.100.206' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.162
country_id: 798544
description:
Jan 13 21:10:35 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.213.39
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=778095 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.106.50
country_id: 3175395
description:
Jan 13 21:11:37 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.106.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.79.22.130
country_id: 1562822
description:
Jan 13 21:14:48 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.79.22.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.79.22.130
country_id: 1562822
description:
2026-01-13 21:14:50 dovecot_login authenticator failed for H=([27.79.22.130]) [27.79.22.130]:61538: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.187
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/monthlyletter/images/events.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.171
country_id: 6290252
description:
Jan 13 21:17:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.186
country_id: 2300660
description:
Jan 13 21:18:00 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.137.122
country_id: 163843
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/Tests/phpt/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.78.174
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.65.157.95
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=940563 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.186
country_id: 2300660
description:
Jan 13 21:18:14 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.235
country_id: 298795
description:
Jan 13 21:18:25 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.3.130
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/Tests/phpt HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.62.73.218
country_id: 1835841
description:
2026-01-13 21:19:26 dovecot_login authenticator failed for H=([211.62.73.218]) [211.62.73.218]:52946: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.141.6
country_id: 3469034
description:
Jan 13 21:20:01 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.141.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.62.73.218
country_id: 1835841
description:
Jan 13 21:19:24 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.62.73.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.12.160
country_id: 2300660
description:
Jan 13 21:20:31 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.12.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.203
country_id: 3175395
description:
Jan 13 21:20:52 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.141.6
country_id: 3469034
description:
Jan 13 21:20:09 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.141.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.98.213.252
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=174516 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.152.79.105
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=634412 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.184.252.93
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=8 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.83.2.183
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=457703 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.147.107.117
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=470762 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.26.198
country_id: 1269750
description:
Jan 13 21:27:58 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.26.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-13 21:28:00 dovecot_login authenticator failed for H=(103.51.26.198.sukaininfoway.com) [103.51.26.198]:45548: 535 Incorrect authentication data (set_id=accounting@maalloys.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.116.165.52
country_id: 6290252
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/products.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.116.165.52
country_id: 6290252
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/products.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60549: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:31:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60549: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.227
country_id: 953987
description:
Jan 13 21:31:41 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.227 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 196.251.100.206
country_id: 241170
description:
2026-01-13 21:31:52 2545786 [Warning] Aborted connection 2545786 to db: 'unconnected' user: 'unauthenticated' host: '196.251.100.206' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.136.66
country_id: 690791
description:
Jan 13 21:33:05 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.136.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.41.34
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=4 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.136.66
country_id: 690791
description:
Jan 13 21:33:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.136.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.192.212.214
country_id: 1733045
domain: www.mokshana.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mokshana.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.115.67.169
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/guzzlehttp/psr7/src/MultipartStream.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/img/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.140.114
country_id: 732800
description:
Jan 13 21:35:23 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.140.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.33.198
country_id: 226074
description:
Jan 13 21:35:29 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.33.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.39
country_id: 3865483
description:
Jan 13 21:36:03 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.39
country_id: 3865483
description:
Jan 13 21:36:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.88.8.36
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=30 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.181.2.130
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=982714 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 116.90.73.12
country_id: 2077456
domain: mkmetal.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.63||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.211.217.127
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=626921 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.164.224.31
country_id: 587116
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=277285 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.79.129.119
country_id: 1562822
description:
Jan 13 21:43:20 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.79.129.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.79.129.119
country_id: 1562822
description:
2026-01-13 21:43:22 dovecot_login authenticator failed for H=([127.0.0.1]) [27.79.129.119]:38271: 535 Incorrect authentication data (set_id=office@nexuscollection.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.66.107
country_id: 1512440
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/video.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.180
country_id: 798544
description:
Jan 13 21:46:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.64.53
country_id: 3469034
description:
Jan 13 21:46:35 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.64.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.79
country_id: 2510769
description:
Jan 13 21:46:55 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.166.101.252
country_id: 1282988
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=359598 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.90
country_id: 953987
description:
Jan 13 21:47:22 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/keyword/img/druma_photos/press.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.233.136.215
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=302004 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 16.146.86.169
country_id: 6252001
domain: www.modern.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/68.0.3440.106 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.110.162
country_id: 798544
description:
Jan 13 21:49:40 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.110.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.6.19
country_id: 2300660
description:
Jan 13 21:50:17 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.6.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/keyword/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.101.179.219
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=975297 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 21:56:19 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.62.57.139
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/index.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:59:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60574: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 21:59:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60574: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 22:00:52 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.155.75
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=558493 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.121.185.116
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=641998 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.86.71
country_id: 1512440
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=5 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.197.150.37
country_id: 3057568
description:
2026-01-13 22:06:38 dovecot_login authenticator failed for H=static-dsl-37.87-197-150.telecom.sk [87.197.150.37]:47156: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.76.238.62
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=670535 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:07:37 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:07:39 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:32633: 535 Incorrect authentication data (set_id=finance@urban.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.160.74.128
country_id: 2921044
description:
Jan 13 22:07:35 sv3 pure-ftpd[1050149]: (?@217.160.74.128) [INFO] New connection from 217.160.74.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.53.57
country_id: 953987
description:
Jan 13 22:08:49 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.53.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.119.63
country_id: 798544
description:
Jan 13 22:08:56 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.119.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.119.63
country_id: 798544
description:
Jan 13 22:09:09 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.119.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.27
country_id: 798544
description:
Jan 13 22:09:22 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.151
country_id: 1269750
description:
Jan 13 22:09:48 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.151
country_id: 1269750
description:
2026-01-13 22:09:50 dovecot_login authenticator failed for H=([122.187.229.151]) [122.187.229.151]:56713: 535 Incorrect authentication data (set_id=finance@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.203
country_id: 3469034
description:
Jan 13 22:10:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.79
country_id: 933860
description:
Jan 13 22:11:23 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:13:00 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (denistming) [87.103.126.54]:60770: 535 Incorrect authentication data (set_id=tom.cheong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:12:58 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:13:13 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:13:15 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (sanistocy) [87.103.126.54]:63073: 535 Incorrect authentication data (set_id=irene.wong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
country_id: 290557
description:
Jan 13 22:14:02 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-13 22:14:04 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:40584: 535 Incorrect authentication data (set_id=finance@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.73.196.243
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=749224 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.124.110.18
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=758571 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:16:13 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:16:15 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (plity) [87.103.126.54]:29273: 535 Incorrect authentication data (set_id=kimting.yap@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.64.133.161
country_id: 2017370
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/guzzlehttp/psr7/src/Stream.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.28.117.27
country_id: 453733
description:
Jan 13 22:19:49 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.28.117.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.230
country_id: 3469034
description:
Jan 13 22:21:10 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.11.138
country_id: 226074
description:
Jan 13 22:21:44 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.11.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.157
country_id: 3469034
description:
Jan 13 22:21:55 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.157
country_id: 3469034
description:
Jan 13 22:22:11 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.157 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.97.235
country_id: 3144096
description:
Jan 13 22:22:24 sv3 pure-ftpd[1058988]: (?@185.253.97.235) [INFO] New connection from 185.253.97.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.199
country_id: 1269750
description:
Jan 13 22:22:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:22:43 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:22:45 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (lercha) [87.103.126.54]:58620: 535 Incorrect authentication data (set_id=marketing@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.65.137.97
country_id: 3996063
description:
Jan 13 22:25:13 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.65.137.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.33
country_id: 1269750
description:
Jan 13 22:25:32 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 18.221.214.151
country_id: 6252001
description:
Jan 13 22:26:30 sv3 pure-ftpd[1061888]: (?@18.221.214.151) [INFO] New connection from 18.221.214.151


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.241.56.251
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/clients.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 22:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60595: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 22:27:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60595: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.104.28.42
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=20 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/images/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.145.126
country_id: 1819730
description:
Jan 13 22:32:31 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.145.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2026-01-13 22:32:33 dovecot_login authenticator failed for H=([223.197.145.126]) [223.197.145.126]:61364: 535 Incorrect authentication data (set_id=contact@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
country_id: 1835841
description:
Jan 13 22:33:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2026-01-13 22:33:28 dovecot_login authenticator failed for H=([1.212.225.99]) [1.212.225.99]:35992: 535 Incorrect authentication data (set_id=contact@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.248
country_id: 3175395
description:
Jan 13 22:33:44 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.248 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/es/img/photos/article.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.143
country_id: 3469034
description:
Jan 13 22:33:23 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.255.21.117
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=936837 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.26
country_id: 3175395
description:
Jan 13 22:34:13 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 13 22:35:33 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-13 22:35:35 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ativolater) [87.103.126.54]:36037: 535 Incorrect authentication data (set_id=info@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.99
country_id: 3469034
description:
Jan 13 22:35:29 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.87.249.76
country_id: 798544
description:
Jan 13 22:39:53 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.87.249.76 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.37.141.65
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=685978 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.81.164
country_id: 337996
description:
2026-01-13 22:40:28 dovecot_plain authenticator failed for H=(6MB1PQ8V7O8RZW8) [196.188.81.164]:56501: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.174.211.42
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=951091 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.227.185.47
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.98.10.70
country_id: 2589581
description:
2026-01-13 22:42:43 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [41.98.10.70]:58902: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.213.28.28
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-43.216.213.28.28||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.135.9
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/checkout.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.243.6.2
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=680282 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.55.102.85
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/news.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.20.67.98
country_id: 783754
description:
Jan 13 22:44:10 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.20.67.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.168.241.57
country_id: 798544
description:
Jan 13 22:44:28 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.168.241.57 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.89.133
country_id: 99237
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=44 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.121.182.225
country_id: 3437598
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/corporate.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.109.114.242
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/product-category.php?id=5 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.50.77.37
country_id: 290557
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/about_us.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.54.190.75
country_id: 3439705
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/organizational.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.145.81
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/contect.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.166.86.228
country_id: 2017370
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/cart.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.4.30.209
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/single-service.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.172.165.155
country_id: 3625428
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-86.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.238.34.111
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739548 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.80.92.92
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Exception/InvalidArgumentException.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 50.4.34.176
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/build/17/334/1715811 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.47
country_id: 798544
description:
Jan 13 22:51:26 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.155.18.237
country_id: 3686110
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=a011-0112 - rsc plain carton HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 22:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60613: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 22:55:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60614: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.12
country_id: 3469034
description:
Jan 13 22:55:52 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.127.251
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/facilities.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.16.188.5
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=600737 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.66
country_id: 3469034
description:
Jan 13 23:03:56 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.66
country_id: 3469034
description:
Jan 13 23:04:11 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.208.117
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=841603 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.106.241.90
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=872055 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.89.205.24
country_id: 1605651
description:
Jan 13 23:07:07 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.89.205.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.186.238
country_id: 2510769
description:
Jan 13 23:06:22 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.183.186.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.205.24
country_id: 1605651
description:
2026-01-13 23:07:09 dovecot_login authenticator failed for H=mx-ll-183.89.205-24.dynamic.3bb.co.th ([127.0.0.1]) [183.89.205.24]:37742: 535 Incorrect authentication data (set_id=inf@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.2.42
country_id: 1269750
description:
Jan 13 23:08:10 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.2.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.17
country_id: 2510769
description:
Jan 13 23:08:58 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.122
country_id: 3469034
description:
Jan 13 23:09:03 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.0.124.60
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=983961 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.231.106
country_id: 1814991
description:
2026-01-13 23:09:10 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [218.29.231.106]:57643: 535 Incorrect authentication data (set_id=purchasing3@ocned.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.17
country_id: 2510769
description:
Jan 13 23:09:11 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.122
country_id: 3469034
description:
Jan 13 23:09:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.63.96.72
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=768301 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.123
country_id: 3865483
description:
Jan 13 23:11:00 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.123
country_id: 3865483
description:
Jan 13 23:11:14 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.119
country_id: 798544
description:
Jan 13 23:11:21 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.150.250.139
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=942320 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/images/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.139.191
country_id: 99237
description:
Jan 13 23:12:08 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.139.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.105.184
country_id: 1269750
description:
Jan 13 23:12:27 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.105.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.72.223.93
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=595675 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.224.223.115
country_id: 3865483
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-63.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/img/photos/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.0.121.147
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1&sub=33 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.104.125
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-60.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 137.255.28.103
country_id: 2395170
description:
2026-01-13 23:15:35 H=([137.255.28.103]) [137.255.28.103]:27907 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 137.255.28.103
country_id: 2395170
description:
2026-01-13 23:17:05 H=([137.255.28.103]) [137.255.28.103]:28265 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.0.105.71
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=126580 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.122
country_id: 690791
description:
Jan 13 23:17:43 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 137.255.28.103
country_id: 2395170
description:
2026-01-13 23:18:09 H=([137.255.28.103]) [137.255.28.103]:28603 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 137.255.28.103
country_id: 2395170
description:
2026-01-13 23:18:51 H=([137.255.28.103]) [137.255.28.103]:28659 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.33.126.204
country_id: 953987
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7352662933.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.62.114
country_id: 1149361
description:
Jan 13 23:19:36 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.62.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.114
country_id: 1149361
description:
2026-01-13 23:19:38 dovecot_login authenticator failed for H=([149.54.62.114]) [149.54.62.114]:46949: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-01-13 23:21:38 dovecot_login authenticator failed for H=(aes-static-177.143.22.125.airtel.in) [128.185.239.182]:39138: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.5.109.4
country_id: 2017370
description:
2026-01-13 23:21:13 dovecot_plain authenticator failed for H=(condelubs) [213.5.109.4]:42056: 535 Incorrect authentication data (set_id=chuanyee.ang@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.239.182
country_id: 1269750
description:
Jan 13 23:21:36 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.239.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.84.173.1
country_id: 3437598
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=784798 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.218.95.154
country_id: 6252001
description:
Jan 13 23:22:22 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.218.95.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-13 23:22:24 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:53037: 535 Incorrect authentication data (set_id=feedback@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 23:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60636: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 23:23:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60637: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.4
country_id: 798544
description:
Jan 13 23:24:09 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.227.16.83
country_id: 3469034
description:
Jan 13 23:25:07 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.227.16.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.227.16.83
country_id: 3469034
description:
Jan 13 23:25:15 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.227.16.83 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.50
country_id: 6252001
description:
2026-01-13 23:26:18 2550168 [Warning] Aborted connection 2550168 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.50' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-13 23:27:23 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:57961: 535 Incorrect authentication data (set_id=feedback@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.218.95.154
country_id: 6252001
description:
Jan 13 23:27:21 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.218.95.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.36.110.152
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-29.154.36.110.152||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.175.210.175
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-29.107.175.210.175||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.100.86.249
country_id: 732800
description:
Jan 13 23:32:05 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.100.86.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.100.86.249
country_id: 732800
description:
Jan 13 23:32:12 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.100.86.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.129.29
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=975825 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.39.99.106
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=138029 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.38
country_id: 6252001
description:
2026-01-13 23:33:11 2550426 [Warning] Aborted connection 2550426 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.38' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.232.162
country_id: 1835841
domain: aircarbonic.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/aircarbonicadmin/public_html/wp-admin||


plugin: modsec
rule: 77140740
name: IM360 WAF: Twenty shell abuse attempt
abuser: 4.217.232.162
country_id: 1835841
domain: aircarbonic.my
description:
IM360 WAF: Twenty shell abuse attempt||MVN:REQUEST_HEADERS:Referer||WPU:||RSV:7.63||T:APACHE||MV:https://www.yahoo.com/||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 223.228.149.146
country_id: 1269750
description:
2026-01-13 23:35:56 H=([117.197.83.45]) [223.228.149.146]:10834 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.226.185
country_id: 3865483
description:
Jan 13 23:36:11 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.226.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.196
country_id: 298795
description:
Jan 13 23:36:34 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 223.228.149.146
country_id: 1269750
description:
2026-01-13 23:36:37 H=([117.197.83.45]) [223.228.149.146]:11068 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.174
country_id: 3469034
description:
Jan 13 23:37:20 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.26.147
country_id: 798544
description:
Jan 13 23:37:42 sv3 auth[944288]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.26.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.58.165.186
country_id: 3439705
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=513447 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.131.178.34
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/07reader.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140740
name: IM360 WAF: Twenty shell abuse attempt
abuser: 4.217.232.162
country_id: 1835841
domain: astlog.com.my
description:
IM360 WAF: Twenty shell abuse attempt||MVN:REQUEST_HEADERS:Referer||WPU:||RSV:7.63||T:APACHE||MV:https://duckduckgo.com/||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.10.85
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-33.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.217.232.162
country_id: 1835841
domain: astlog.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/astlogc/public_html/wp-admin/images/admin.php||


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 13 23:42:03 sv3 dovecot[1115219]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.98.241
country_id: 3469034
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=7742162736 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.204.208.171
country_id: 2017370
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/carry/12/669/1267736 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.177.133
country_id: 6252001
description:
Jan 13 23:44:40 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.173.177.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-13 23:44:42 dovecot_login authenticator failed for H=(emcbz) [107.173.177.133]:50670: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.237.188.208
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=501726 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.96.89.124
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-48.172.96.89.124||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 23:48:39 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.100
country_id: 953987
description:
Jan 13 23:50:16 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 23:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60659: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-13 23:51:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60659: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.190.14.165
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=168924 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/druma/index.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.202.207
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=568838 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.215.133
country_id: 933860
description:
Jan 13 23:53:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.215.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 13 23:53:13 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-13 23:56:29 H=([45.144.212.54]) [45.144.212.54]:63910 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/osl.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-14 00:00:18 H=([45.144.212.54]) [45.144.212.54]:50576 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.186.76.5
country_id: 1168579
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-26.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.153.19.131
country_id: 2510769
description:
Jan 14 00:05:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.153.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.85
country_id: 798544
description:
Jan 14 00:05:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.179.38.132
country_id: 2017370
description:
Jan 14 00:07:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.179.38.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.179.38.132
country_id: 2017370
description:
2026-01-14 00:07:48 dovecot_plain authenticator failed for H=(eciang) [82.179.38.132]:59475: 535 Incorrect authentication data (set_id=cheehian.ooi@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
country_id: 1835841
description:
Jan 14 00:08:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-01-14 00:08:32 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:40364: 535 Incorrect authentication data (set_id=help@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
country_id: 99237
description:
Jan 14 00:09:55 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2026-01-14 00:09:57 dovecot_login authenticator failed for H=([185.255.47.190]) [185.255.47.190]:48492: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.139.220
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/mockery/mockery/docs/getting_started/map.rst.inc||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.0.233.116
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/recycling.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
country_id: 1835841
description:
Jan 14 00:11:55 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-01-14 00:11:57 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:49912: 535 Incorrect authentication data (set_id=help@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.68
country_id: 2395170
description:
Jan 14 00:12:07 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.172.106.105
country_id: 1814991
description:
Jan 14 00:11:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.172.106.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.172.106.105
country_id: 1814991
description:
2026-01-14 00:11:11 dovecot_login authenticator failed for H=([117.172.106.105]) [117.172.106.105]:53794: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.203
country_id: 953987
description:
Jan 14 00:11:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.85
country_id: 798544
description:
Jan 14 00:11:22 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.48
country_id: 690791
description:
Jan 14 00:11:41 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.68
country_id: 2395170
description:
Jan 14 00:12:15 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.178.69.26
country_id: 3703430
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/always/669/697953 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.249
country_id: 3175395
description:
Jan 14 00:14:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.160.73
country_id: 3469034
description:
Jan 14 00:14:22 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.160.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.4
country_id: 798544
description:
Jan 14 00:15:36 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.12
country_id: 3469034
description:
Jan 14 00:15:36 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.232.223.6
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/training-details.php?id=491477 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.249
country_id: 3175395
description:
Jan 14 00:15:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 00:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60702: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 00:19:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60702: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.210.35.147
country_id: 390903
description:
Jan 14 00:20:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.210.35.147 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.50.0.111
country_id: 4566966
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/big/516/213045 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.35.147
country_id: 390903
description:
2026-01-14 00:20:04 dovecot_plain authenticator failed for H=(uness) [149.210.35.147]:59646: 535 Incorrect authentication data (set_id=webmaster@fkr.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.87.249.76
country_id: 798544
description:
Jan 14 00:20:45 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.87.249.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-01-14 00:23:25 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:36970: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.32.41.16
country_id: 798549
description:
Jan 14 00:24:25 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.32.41.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.32.41.16
country_id: 798549
description:
2026-01-14 00:24:27 dovecot_login authenticator failed for H=(ADMIN) [89.32.41.16]:46086: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.142.184.55
country_id: 1210997
description:
Jan 14 00:26:33 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.142.184.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-14 00:26:35 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:38168: 535 Incorrect authentication data (set_id=salesmp@aoto.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.133.161
country_id: 3175395
description:
Jan 14 00:27:28 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.133.161 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.142.154.34
country_id: 1819730
description:
2026-01-14  0:28:02 1657 [Warning] Aborted connection 1657 to db: 'unconnected' user: 'unauthenticated' host: '45.142.154.34' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.89.164.226
country_id: 2635167
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.239.28
country_id: 3469034
description:
Jan 14 00:34:43 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.239.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.42.46.35
country_id: 4566966
description:
2026-01-14 00:34:49 dovecot_login authenticator failed for H=(solitude.engreensolutions.com.) [24.42.46.35]:39078: 535 Incorrect authentication data (set_id=rajanazrul@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.237
country_id: 3469034
description:
Jan 14 00:36:52 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.173
country_id: 2300660
description:
Jan 14 00:37:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.216.191
country_id: 1269750
description:
2026-01-14 00:38:06 dovecot_plain authenticator failed for H=(zyrthb4x0jz0dhbwio9s3) [59.93.216.191]:51066: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-14 00:38:15 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:41317: 535 Incorrect authentication data (set_id=press@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.159.187
country_id: 1733045
description:
Jan 14 00:38:41 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.159.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.187
country_id: 1733045
description:
2026-01-14 00:38:43 dovecot_login authenticator failed for H=([49.124.159.187]) [49.124.159.187]:51404: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.115.138.235
country_id: 617790
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7018710133.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.94.52.223
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-41.23.94.52.223||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.20
country_id: 3469034
description:
Jan 14 00:42:52 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.216.40.166
country_id: 6290252
description:
Jan 14 00:43:07 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.216.40.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.216.40.166
country_id: 6290252
description:
Jan 14 00:43:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.216.40.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.111
country_id: 798544
description:
Jan 14 00:43:25 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.10.31.238
country_id: 719819
description:
Jan 14 00:44:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.10.31.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.166.102
country_id: 3469034
description:
Jan 14 00:45:01 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.166.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.166.102
country_id: 3469034
description:
Jan 14 00:45:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.166.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.225
country_id: 3865483
description:
Jan 14 00:46:17 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 00:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60723: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 00:47:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60723: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.198.20.189
country_id: 3996063
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/category/uncategorized HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.1.86
country_id: 798544
description:
Jan 14 00:49:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.1.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.203
country_id: 3469034
description:
Jan 14 00:49:40 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.82.103
country_id: 3469034
description:
Jan 14 00:50:34 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.82.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.48
country_id: 798544
description:
Jan 14 00:57:16 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.27.203
country_id: 3469034
description:
Jan 14 01:05:43 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.27.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.115
country_id: 1269750
description:
Jan 14 01:06:05 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.127.99.184
country_id: 798549
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/intervention/image/src/config/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.255.86.174
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tyre_safety_tips_importance_correct_inflation.html HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.124.111.122
country_id: 2077456
description:
Jan 14 01:07:42 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.124.111.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-01-14 01:07:44 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:58189: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/rpl.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.36.4
country_id: 3469034
description:
[2026-01-14 01:10:42 +0800] info [cpaneld] 181.189.36.4 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.227
country_id: 3469034
description:
Jan 14 01:10:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.5.107.179
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=500196 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.196
country_id: 3175395
description:
Jan 14 01:10:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.19
country_id: 798544
description:
Jan 14 01:12:57 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.19
country_id: 798544
description:
Jan 14 01:13:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.245
country_id: 2510769
description:
Jan 14 01:13:44 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.26.169
country_id: 3469034
description:
Jan 14 01:14:04 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.26.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 01:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60751: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.26.169
country_id: 3469034
description:
Jan 14 01:14:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.26.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 01:15:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60752: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.150
country_id: 3865483
description:
Jan 14 01:16:59 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.165
country_id: 3865483
description:
Jan 14 01:16:35 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-14 01:17:38 dovecot_login authenticator failed for H=([144.121.245.65]) [64.72.74.162]:38812: 535 Incorrect authentication data (set_id=orders@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.228
country_id: 6290252
description:
Jan 14 01:17:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.141
country_id: 3175395
description:
Jan 14 01:17:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.29.241
country_id: 1835841
description:
2026-01-14 01:17:36 dovecot_login authenticator failed for H=([127.0.0.1]) [112.160.29.241]:56929: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.160.29.241
country_id: 1835841
description:
Jan 14 01:17:34 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.160.29.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jan 14 01:17:36 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.103
country_id: 6252001
description:
2026-01-14  1:17:42 3463 [Warning] Aborted connection 3463 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.103' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.150
country_id: 3865483
description:
Jan 14 01:17:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.13.27.11
country_id: 1814991
description:
Jan 14 01:17:15 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.13.27.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.27.11
country_id: 1814991
description:
2026-01-14 01:17:17 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.27.11]:33089: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.44.146.150
country_id: 1168579
domain: mail.uumism.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.uumism.edu.my/cgi-bin HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.165.217.77
country_id: 3865483
domain: mail.uumism.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.uumism.edu.my/cgi-bin/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jan 14 01:20:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-14 01:20:21 dovecot_plain authenticator failed for H=(balatione) [64.72.74.162]:47469: 535 Incorrect authentication data (set_id=feiteen.gan@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
country_id: 2542007
description:
Jan 14 01:22:06 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-14 01:22:08 dovecot_plain authenticator failed for H=(undip) [102.53.15.18]:46476: 535 Incorrect authentication data (set_id=kimting.yap@tujusetia.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.71.107
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-22.142.111.71.107||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2026-01-14 01:23:27 dovecot_login authenticator failed for H=([46.8.240.44]) [46.8.240.44]:38288: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.195.138.52
country_id: 6252001
description:
Jan 14 01:24:05 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.195.138.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.54
country_id: 1269750
description:
Jan 14 01:23:13 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.8.240.44
country_id: 2017370
description:
Jan 14 01:23:25 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.8.240.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.58.83.146
country_id: 3175395
description:
Jan 14 01:24:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.58.83.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.83.146
country_id: 3175395
description:
2026-01-14 01:24:04 dovecot_login authenticator failed for H=([101.58.83.146]) [101.58.83.146]:58655: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-14 01:24:07 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (congronval) [98.195.138.52]:44736: 535 Incorrect authentication data (set_id=shirley.wong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.234.11.10
country_id: 2017370
description:
Jan 14 01:24:21 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.234.11.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.11.10
country_id: 2017370
description:
2026-01-14 01:24:23 dovecot_login authenticator failed for H=([213.234.11.10]) [213.234.11.10]:59106: 535 Incorrect authentication data (set_id=nicholas@eminent.st)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.237.39.5
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=80411523583765 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.181.166
country_id: 1269750
description:
Jan 14 01:24:52 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.181.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-01-14 01:24:54 dovecot_login authenticator failed for H=(nsg-static-089.96.71.182.airtel.in) [182.95.181.166]:38820: 535 Incorrect authentication data (set_id=nicholas)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.40.64.155
country_id: 1269750
description:
Jan 14 01:26:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.40.64.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.46.7.146
country_id: 1522867
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=35 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.218.228.187
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=758571 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.232.22.142
country_id: 3144096
description:
Jan 14 01:28:24 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.232.22.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.22.142
country_id: 3144096
description:
2026-01-14 01:28:26 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.22.142]:49873: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.154.214.12
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-28.192.154.214.12||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.170.162
country_id: 1269750
description:
Jan 14 01:28:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.170.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.170.162
country_id: 1269750
description:
2026-01-14 01:28:14 dovecot_login authenticator failed for H=([127.0.0.1]) [125.19.170.162]:49638: 535 Incorrect authentication data (set_id=info@pspoly.com.my)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 34.85.205.29
country_id: 6252001
description:
[2026-01-14 01:29:46 +0800] info [cpaneld] 34.85.205.29 - - "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jan 14 01:29:30 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.85.205.29
country_id: 6252001
description:
[2026-01-14 01:29:42 +0800] info [cpaneld] 34.85.205.29 - - "GET /wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-14 01:29:32 dovecot_plain authenticator failed for H=(masunfal) [64.72.74.162]:35473: 535 Incorrect authentication data (set_id=admin@usfood.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.229.206
country_id: 1269750
description:
Jan 14 01:30:20 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.13.27.11
country_id: 1814991
description:
Jan 14 01:30:20 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.13.27.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.131.14.61
country_id: 2510769
description:
Jan 14 01:30:07 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.131.14.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.27.11
country_id: 1814991
description:
2026-01-14 01:30:22 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.27.11]:39739: 535 Incorrect authentication data (set_id=arts@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.206
country_id: 1269750
description:
2026-01-14 01:30:22 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.229.206]:39638: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-14 01:30:37 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:52285: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.213.218.254
country_id: 2635167
description:
Jan 14 01:30:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.213.218.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.213.218.254
country_id: 2635167
description:
2026-01-14 01:31:00 dovecot_login authenticator failed for H=([127.0.0.1]) [89.213.218.254]:39886: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.131.14.61
country_id: 2510769
description:
2026-01-14 01:30:09 dovecot_login authenticator failed for H=([127.0.0.1]) [185.131.14.61]:57960: 535 Incorrect authentication data (set_id=no-reply@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.160.166.161
country_id: 1835841
description:
Jan 14 01:31:26 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.160.166.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2026-01-14 01:31:28 dovecot_login authenticator failed for H=([121.160.166.161]) [121.160.166.161]:54734: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.174.134
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/c-57.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.106
country_id: 6252001
description:
2026-01-14  1:32:09 3960 [Warning] Aborted connection 3960 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.106' (This connection closed normally without authentication)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 47.238.71.125
country_id: 1819730
domain: www.manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/105.0.5195.19 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.230.25.156
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/ramsey/uuid/src/UuidInterface.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.178
country_id: 6252001
description:
Jan 14 01:33:52 sv3 pure-ftpd[1185959]: (?@205.210.31.178) [INFO] New connection from 205.210.31.178


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.141
country_id: 6252001
description:
Jan 14 01:35:14 sv3 pure-ftpd[1186932]: (?@198.235.24.141) [INFO] New connection from 198.235.24.141


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.32.113.39
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=541954 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.128.81.152
country_id: 285570
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&sub=26 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.239.196
country_id: 3469034
description:
Jan 14 01:37:33 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.239.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.65
country_id: 798544
description:
Jan 14 01:37:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-14 01:38:48 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:50935: 535 Incorrect authentication data (set_id=legal@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jan 14 01:38:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.208.46.130
country_id: 1522867
description:
Jan 14 01:40:05 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.208.46.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 34.85.205.29
country_id: 6252001
description:
[2026-01-14 01:39:34 +0800] info [cpaneld] 34.85.205.29 - - "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
country_id: 2542007
description:
Jan 14 01:39:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-14 01:39:48 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:54982: 535 Incorrect authentication data (set_id=legal@nexuscollection.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.136.160.211
country_id: 3017382
description:
2026-01-14  1:40:01 4228 [Warning] Aborted connection 4228 to db: 'unconnected' user: 'unauthenticated' host: '185.136.160.211' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.85.205.29
country_id: 6252001
description:
[2026-01-14 01:39:30 +0800] info [cpaneld] 34.85.205.29 - - "GET /wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.128.15
country_id: 732800
description:
Jan 14 01:39:51 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.128.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.239.151.10
country_id: 3932488
description:
Jan 14 01:39:58 sv3 pure-ftpd[1190181]: (?@185.239.151.10) [INFO] New connection from 185.239.151.10


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.239.151.35
country_id: 3932488
description:
Jan 14 01:40:00 sv3 pure-ftpd[1190196]: (?@185.239.151.35) [INFO] New connection from 185.239.151.35


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-14 01:40:07 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:53193: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.237.250.144
country_id: 192950
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/enquiry.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jan 14 01:40:20 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-14 01:40:22 dovecot_plain authenticator failed for H=(manale) [64.72.74.162]:41276: 535 Incorrect authentication data (set_id=sales@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 01:40:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.7.16.75
country_id: 3932488
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/service.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jan 14 01:41:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.127.34.2
country_id: 3469034
description:
Jan 14 01:40:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.127.34.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.28.90.136
country_id: 3923057
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/resize.php?h=360&img=img/category_photos/59477378.jpg&w=360 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.208.55.100
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=2 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jan 14 01:41:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 01:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60783: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.236
country_id: 3469034
description:
Jan 14 01:43:03 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.236 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/m.me/images/team.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.236
country_id: 3469034
description:
Jan 14 01:43:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 01:43:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60784: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.43
country_id: 3469034
description:
Jan 14 01:44:39 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.54
country_id: 3175395
description:
Jan 14 01:45:03 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 01:45:31 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.54
country_id: 3175395
description:
Jan 14 01:45:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.32
country_id: 3077311
description:
Jan 14 01:46:47 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.150.66.253
country_id: 3585968
description:
2026-01-14 01:48:45 H=([190.150.66.253]) [190.150.66.253]:43880 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.150.66.253
country_id: 3585968
description:
2026-01-14 01:49:27 H=([190.150.66.253]) [190.150.66.253]:63946 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 190.150.66.253
country_id: 3585968
description:
2026-01-14 01:50:09 H=([190.150.66.253]) [190.150.66.253]:65117 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.160.71.25
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-52.167.160.71.25||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.83.79.160
country_id: 1819730
domain: nobledec.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/assets/images/index.php||SC:/home2/nobledec/public_html/assets/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.123.229.23
country_id: 3703430
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.156
country_id: 3865483
description:
Jan 14 01:55:21 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.223
country_id: 3469034
description:
Jan 14 01:55:47 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.223 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.83.179.150
country_id: 3573591
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/country/19/122/1955397 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.79.194
country_id: 3686110
description:
Jan 14 01:57:21 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.79.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-14 02:00:54 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:43960: 535 Incorrect authentication data (set_id=dmca@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.17
country_id: 3175395
description:
Jan 14 02:03:04 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.6.19
country_id: 2300660
description:
Jan 14 02:03:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.6.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.177.100
country_id: 3469034
description:
Jan 14 02:03:55 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.177.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.6.19
country_id: 2300660
description:
Jan 14 02:03:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.6.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.17
country_id: 3175395
description:
Jan 14 02:03:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.237.1
country_id: 1562822
description:
2026-01-14 02:03:16 dovecot_login authenticator failed for H=([127.0.0.1]) [27.74.237.1]:60825: 535 Incorrect authentication data (set_id=info@pspoly.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.71.66.60
country_id: 3469034
description:
Jan 14 02:03:45 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.71.66.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.177.100
country_id: 3469034
description:
Jan 14 02:04:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.177.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.177
country_id: 2510769
description:
Jan 14 02:04:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.168.88
country_id: 2186224
description:
Jan 14 02:06:44 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.168.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.88
country_id: 2186224
description:
2026-01-14 02:06:46 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.168.88]:51372: 535 Incorrect authentication data (set_id=fadilah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.186.230.20
country_id: 1562822
description:
Jan 14 02:06:25 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.186.230.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.186.230.20
country_id: 1562822
description:
2026-01-14 02:06:27 dovecot_login authenticator failed for H=([127.0.0.1]) [113.186.230.20]:41232: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/font/fontello09eb.woff?22036640 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.194.8.228
country_id: 99237
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/about.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.238
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/css/animation.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.137
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/__packed.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.185
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/css/fontello.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.244.255.2
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.220
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/shortcodes.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.186
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/kidscare.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.153
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/responsive.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.215.220.109
country_id: 798544
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/run/dovecot/dovecot.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
country_id: 1835841
description:
Jan 14 02:09:23 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2026-01-14 02:09:25 dovecot_login authenticator failed for H=([222.117.0.253]) [222.117.0.253]:55858: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.60
country_id: 953987
description:
Jan 14 02:10:31 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.32.83
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78381515570735 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.97.118
country_id: 3469034
description:
Jan 14 02:10:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.97.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 02:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60809: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.97.118
country_id: 3469034
description:
Jan 14 02:11:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.97.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.150.243.22
country_id: 6252001
description:
Jan 14 02:11:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.150.243.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-14 02:11:13 dovecot_plain authenticator failed for H=(holowls) [12.150.243.22]:2383: 535 Incorrect authentication data (set_id=info@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 02:11:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60810: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
country_id: 1835841
description:
Jan 14 02:12:27 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-14 02:12:29 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:43518: 535 Incorrect authentication data (set_id=dmca@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.196.35
country_id: 1562822
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.28.129
country_id: 1562822
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/SUU_4225 (1).jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.53.237.132
country_id: 1168579
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/logo-footer-new.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.29.19.115
country_id: 294640
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/slidernew.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.76.151
country_id: 3469034
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/exec-chairman-msg.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.6.27.128
country_id: 3469034
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/DSC00502 (1).jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.15.190
country_id: 1562822
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/background_about.jpg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.70.196.115
country_id: 2661886
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/images/logo-maa-new.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.43
country_id: 3469034
description:
Jan 14 02:14:06 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.189
country_id: 3865483
description:
Jan 14 02:15:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.43
country_id: 3469034
description:
Jan 14 02:14:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.46
country_id: 3469034
description:
Jan 14 02:14:37 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.189
country_id: 3865483
description:
Jan 14 02:15:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
country_id: 1814991
description:
Jan 14 02:16:00 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2026-01-14 02:16:02 dovecot_login authenticator failed for H=([118.183.180.108]) [118.183.180.108]:17192: 535 Incorrect authentication data (set_id=hapiz@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.20.31
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=432867 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.178.206
country_id: 1269750
description:
Jan 14 02:19:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.178.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2026-01-14 02:19:21 dovecot_login authenticator failed for H=([182.95.178.206]) [182.95.178.206]:42270: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
country_id: 458258
description:
Jan 14 02:21:52 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-14 02:21:54 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:34704: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.205.226
country_id: 3469034
description:
Jan 14 02:23:33 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.205.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-14 02:23:41 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:59283: 535 Incorrect authentication data (set_id=offers@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.0.55.229
country_id: 1814991
description:
Jan 14 02:25:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.0.55.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.0.55.229
country_id: 1814991
description:
2026-01-14 02:25:16 dovecot_login authenticator failed for H=([218.0.55.229]) [218.0.55.229]:41716: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-01-14 02:25:21 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [121.202.138.181]:59662: 535 Incorrect authentication data (set_id=slgoh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.138.181
country_id: 1819730
description:
Jan 14 02:25:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.138.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.138.198
country_id: 1814991
description:
Jan 14 02:26:03 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.138.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.138.198
country_id: 1814991
description:
2026-01-14 02:26:05 dovecot_login authenticator failed for H=([150.129.138.198]) [150.129.138.198]:59069: 535 Incorrect authentication data (set_id=general)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.200.180.174
country_id: 6252001
description:
Jan 14 02:26:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.200.180.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2026-01-14 02:27:00 dovecot_login authenticator failed for H=survey.hagbergconsulting.com [207.200.180.174]:61870: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.205
country_id: 2395170
description:
Jan 14 02:27:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-14 02:30:27 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:50068: 535 Incorrect authentication data (set_id=offers@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.237.58
country_id: 1269750
description:
Jan 14 02:30:34 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.237.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.58
country_id: 1269750
description:
2026-01-14 02:30:36 dovecot_login authenticator failed for H=([127.0.0.1]) [125.23.237.58]:37850: 535 Incorrect authentication data (set_id=wanfazris@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.130.35.13
country_id: 1668284
description:
Jan 14 02:30:49 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.130.35.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.130.35.13
country_id: 1668284
description:
2026-01-14 02:30:51 dovecot_login authenticator failed for H=220-130-35-13.hinet-ip.hinet.net ([127.0.0.1]) [220.130.35.13]:49827: 535 Incorrect authentication data (set_id=wanfazris)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 175.44.2.144
country_id: 1814991
domain: www.kendek.com
description:
IM360 WAF: Bad file extension||RSV:7.63||T:APACHE||MVN:REQUEST_FILENAME||MV:/mailto:stefen@kendek.com||User:kendek||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.232.60.66
country_id: 3469034
description:
Jan 14 02:33:50 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.232.60.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.24.202.135
country_id: 798544
description:
Jan 14 02:34:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.24.202.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/sliders/survey-meter.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.116
country_id: 690791
description:
Jan 14 02:37:24 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.79
country_id: 1269750
description:
Jan 14 02:37:55 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.79
country_id: 1269750
description:
Jan 14 02:38:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.57.74.195
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-38.72.57.74.195||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 02:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60829: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 02:39:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60830: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.187
country_id: 1269750
description:
Jan 14 02:41:00 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.147.137.78
country_id: 2542007
description:
2026-01-14 02:40:49 dovecot_plain authenticator failed for H=([172.31.240.1]) [197.147.137.78]:54961: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.187
country_id: 1269750
description:
Jan 14 02:41:13 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.119
country_id: 298795
description:
Jan 14 02:41:16 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.147.137.78
country_id: 2542007
description:
2026-01-14 02:41:26 dovecot_plain authenticator failed for H=([172.31.240.1]) [197.147.137.78]:55147: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.147.137.78
country_id: 2542007
description:
2026-01-14 02:42:41 dovecot_plain authenticator failed for H=([172.31.240.1]) [197.147.137.78]:50355: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.30
country_id: 3077311
description:
Jan 14 02:42:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.82
country_id: 3175395
description:
Jan 14 02:42:38 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.147.137.78
country_id: 2542007
description:
2026-01-14 02:43:15 dovecot_plain authenticator failed for H=([172.31.240.1]) [197.147.137.78]:64528: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.189.89.85
country_id: 3895114
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=b031-0001 - rsc plain carton HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.31
country_id: 1269750
description:
Jan 14 02:50:33 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.48.40
country_id: 2963597
description:
Jan 14 02:52:35 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.48.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.96
country_id: 3175395
description:
Jan 14 02:52:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.52.3.146
country_id: 6252001
domain: www.aircarbonic.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.52.3.146
country_id: 6252001
domain: www.aircarbonic.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3865.120 Safari/537.36||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.138.139
country_id: 3175395
description:
Jan 14 02:53:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.138.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.86.158.1
country_id: 102358
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/busy/14/379/1448284 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.138.138
country_id: 3996063
description:
Jan 14 02:53:41 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.209.2
country_id: 933860
description:
Jan 14 02:55:44 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.209.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.134.51.80
country_id: 6252001
domain: tujusetia.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.116.175.137
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=724064 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.150
country_id: 3469034
description:
Jan 14 02:56:44 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.130
country_id: 3469034
description:
Jan 14 02:56:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.70
country_id: 3175395
description:
Jan 14 02:56:39 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.101.28.201
country_id: 2589581
description:
2026-01-14 02:58:38 H=([105.101.28.201]) [105.101.28.201]:33514 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.15.237
country_id: 99237
domain: www.symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.symphony-led.com/products/media-facade-2/outdoor-led-screen-c1-series/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.101.28.201
country_id: 2589581
description:
2026-01-14 02:59:48 H=([105.101.28.201]) [105.101.28.201]:34031 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.168.50.165
country_id: 3469034
description:
2026-01-14 02:59:15 H=([45.168.50.199]) [45.168.50.165]:38434 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.168.50.234
country_id: 3469034
description:
2026-01-14 03:00:33 H=([45.168.50.199]) [45.168.50.234]:38914 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.148.249.72
country_id: 6252001
description:
[2026-01-14 03:01:01 +0800] info [cpaneld] 34.148.249.72 - - "GET /wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 34.148.249.72
country_id: 6252001
description:
[2026-01-14 03:01:06 +0800] info [cpaneld] 34.148.249.72 - - "GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.101.28.201
country_id: 2589581
description:
2026-01-14 03:00:29 H=([105.101.28.201]) [105.101.28.201]:34310 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 105.101.28.201
country_id: 2589581
description:
2026-01-14 03:01:10 H=([105.101.28.201]) [105.101.28.201]:34342 F=<info@imax.com.my> rejected RCPT <info@imax.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.168.50.234
country_id: 3469034
description:
2026-01-14 03:01:20 H=([45.168.50.199]) [45.168.50.234]:39207 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.250.179.209
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/28iterator.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.244
country_id: 3469034
description:
Jan 14 03:05:15 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.203
country_id: 298795
description:
Jan 14 03:05:37 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.211
country_id: 3469034
description:
Jan 14 03:05:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 03:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60858: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.137.8.136
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-06.64.137.8.136||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.243.119
country_id: 6252001
description:
2026-01-14 03:06:57 H=([91.92.243.119]) [91.92.243.119]:52463 F=<ribarra@pasa.mx> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 03:07:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60858: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.163
country_id: 3175395
description:
Jan 14 03:09:20 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.140.123.15
country_id: 6290252
description:
Jan 14 03:09:21 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.140.123.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.81
country_id: 3865483
description:
Jan 14 03:09:43 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-14 03:11:44 H=(localhost.localdomain) [78.153.140.207]:33644 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.38.16.219
country_id: 6252001
description:
Jan 14 03:12:20 sv3 pure-ftpd[1241408]: (?@45.38.16.219) [WARNING] Authentication failed for user [woodlinetrd]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.32
country_id: 3077311
description:
Jan 14 03:14:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.29.15.93
country_id: 3439705
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/img-sys/powered_by_cpanel.svg HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.236.147
country_id: 1562822
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/img-sys/server_misconfigured.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.132.227
country_id: 953987
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.132.227
country_id: 953987
domain: af-sb.comhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.comhttp/af-sb.com/ HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.154.36
country_id: 99237
description:
Jan 14 03:15:23 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.154.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.236.53.198
country_id: 1814991
description:
Jan 14 03:16:58 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.236.53.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.236.53.198
country_id: 1814991
description:
2026-01-14 03:17:00 dovecot_login authenticator failed for H=([115.236.53.198]) [115.236.53.198]:46246: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.53.189
country_id: 2635167
description:
Jan 14 03:17:06 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.53.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/images/services.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.25.93.177
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=381667 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.231.114
country_id: 1269750
description:
Jan 14 03:18:22 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.231.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2026-01-14 03:18:24 dovecot_login authenticator failed for H=([182.95.13.25]) [128.185.231.114]:43218: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/survey-meter.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.47.146
country_id: 1819730
description:
Jan 14 03:23:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.47.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-14 03:23:48 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:49781: 535 Incorrect authentication data (set_id=michaelchin.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/languages/images/sliders/radioactive.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.237
country_id: 3469034
description:
Jan 14 03:24:46 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.45
country_id: 298795
description:
Jan 14 03:25:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.212
country_id: 3469034
description:
Jan 14 03:26:10 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.134
country_id: 3469034
description:
Jan 14 03:26:38 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.207.86.137
country_id: 2017370
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/shout/454/636567 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.56
country_id: 732800
description:
Jan 14 03:28:45 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.168.34.113
country_id: 6252001
description:
Jan 14 03:31:24 sv3 pure-ftpd[1258392]: (?@206.168.34.113) [INFO] New connection from 206.168.34.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 03:33:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.249
country_id: 3175395
description:
Jan 14 03:33:34 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.23
country_id: 3175395
description:
Jan 14 03:33:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.81
country_id: 3865483
description:
Jan 14 03:34:41 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 03:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60889: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 03:35:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60889: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.216
country_id: 3469034
description:
Jan 14 03:36:06 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.11.198
country_id: 690791
description:
Jan 14 03:36:27 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.11.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.144
country_id: 3469034
description:
Jan 14 03:36:47 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.216
country_id: 3469034
description:
Jan 14 03:36:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.248.32
country_id: 798544
description:
Jan 14 03:38:02 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.248.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.45
country_id: 3175395
description:
Jan 14 03:37:19 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 14 03:37:51 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.248.32
country_id: 798544
description:
Jan 14 03:38:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.248.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.202
country_id: 3175395
description:
Jan 14 03:38:20 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.102.66.7
country_id: 2542007
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/9421503242.jpg&size=1000x1000 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-14 03:41:36 H=([77.83.39.92]) [77.83.39.92]:57657 F=<MeshalAbdulwhab@outlook.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 77.83.39.92 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.119.112.69
country_id: 6252001
description:
Jan 14 03:45:25 sv3 pure-ftpd[1266205]: (?@135.119.112.69) [INFO] New connection from 135.119.112.69


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.72.136
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=19 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.43.184.206
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-47.45.43.184.206||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.246.211
country_id: 3865483
description:
Jan 14 03:47:35 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.246.211 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/fancybox/jquery.fancybox.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.140
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/animations/animate.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/ytplayer/css/YTPlayer.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/miuiconfont/miuiconfont.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/vendor/rs-plugin/css/settings.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/vendor/rs-plugin/css/layers.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/css/bootstrap.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/images/article.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.202.83
country_id: 3469034
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/product-sub.php?id=24&sub=29 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/css/pages-style.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/fontawesome/css/font-awesome.min.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kimmark.com/assets/js/bxslider/jquery.bxslider.css HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.125
country_id: 798544
description:
Jan 14 03:52:50 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.203
country_id: 2510769
description:
Jan 14 03:53:07 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.16
country_id: 798544
description:
Jan 14 03:52:18 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.82.82
country_id: 2328926
description:
Jan 14 03:53:12 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.82.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.203
country_id: 2510769
description:
Jan 14 03:53:14 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.16
country_id: 798544
description:
Jan 14 03:53:37 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.229
country_id: 3469034
description:
Jan 14 03:53:37 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/index.php/images/portfolio-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.60
country_id: 3469034
description:
Jan 14 03:57:53 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.37.31.106
country_id: 1168579
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/images/p-4.png HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.60
country_id: 3469034
description:
Jan 14 03:58:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.83.101.22
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/come/16/156/1651009 HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.18
country_id: 3469034
description:
Jan 14 03:58:50 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.96
country_id: 3469034
description:
Jan 14 03:58:55 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.154
country_id: 3469034
description:
Jan 14 03:59:08 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.96
country_id: 3469034
description:
Jan 14 03:59:11 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.12.87
country_id: 2510769
description:
Jan 14 03:59:43 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.12.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.120.129.7
country_id: 690791
description:
Jan 14 04:00:09 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.120.129.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.185
country_id: 3469034
description:
Jan 14 04:00:29 sv3 auth[1115238]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 44.244.53.83
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/img/blog/mon/particulier/loginform3ad6.php||SC:/home2/cabecom/public_html/img/blog||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 04:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60917: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.44.8.235
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/26utf8.php HTTP/1.1||RSV:7.63||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-14 04:03:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:60918: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/images/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.63||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.221.55.57
country_id: 1269750
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-12.103.221.55.57||RSV:7.63||T:APACHE||


