# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
country_id: 1814991
description:
Jan 25 06:17:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-01-25 06:17:15 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:44570: 535 Incorrect authentication data (set_id=info@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.164.176.179
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/css/extralayers.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.181.181.45
country_id: 1210997
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/css/style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 140.84.162.226
country_id: 3996063
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/css/style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.131.104.165
country_id: 290291
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/bootstrap/js/bootstrap.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.43.154.240
country_id: 2963597
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.90.167
country_id: 3865483
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/moderniz.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.208.56.191
country_id: 3996063
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/font-awesome/fonts/fontawesome-webfont862f.woff?v=4.1.0 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.194.188.35
country_id: 3996063
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery-1.11.1.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.0.167.248
country_id: 163843
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/js/app.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.174.209.212
country_id: 831053
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/owl/owl-carousel/owl.theme.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.57.235.98
country_id: 1522867
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery.sticky.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.8.97.188
country_id: 3625428
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/rs-plugin/js/jquery.themepunch.tools.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.153.86
country_id: 99237
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/font-awesome/css/font-awesome.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.208.29
country_id: 953987
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery.mmenu.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.26.14.237
country_id: 3865483
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/feature.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.61.55
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/owl/owl-carousel/owl.carousel.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.31.178.38
country_id: 1210997
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/owl/owl-carousel/owl.carousel.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.241.163
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/cube/jquery.cubeportfolio.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.171.60.42
country_id: 3625428
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/rs-plugin/js/jquery.themepunch.revolution.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.241.59
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery.mmenu.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.148.180.232
country_id: 3686110
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/cube/cubeportfolio.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.45.156.48
country_id: 3895114
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/rs-plugin/css/settings.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 06:19:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 06:19:56 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:55359: 535 Incorrect authentication data (set_id=prints)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.83.25.136
country_id: 3017382
description:
[2026-01-25 06:21:24 +0800] info [whostmgrd] 89.83.25.136 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.180
country_id: 798544
description:
Jan 25 06:21:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.57.100
country_id: 1269750
description:
Jan 25 06:22:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.57.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.73.163.202
country_id: 953987
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/product-knowledge.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.121.102
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/debug/Tests/Fixtures/FinalClasses.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.249.112
country_id: 3625428
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/index-3.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.177.129
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=62511515979613 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.33.67.229
country_id: 3469034
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/product-details.php?id=602547 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 06:33:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 06:33:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57190: 535 Incorrect authentication data (set_id=recona)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.125
country_id: 6252001
description:
2026-01-25  6:33:40 679967 [Warning] Aborted connection 679967 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.125' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 06:35:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.163.154.54
country_id: 3895114
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=212395 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.23.121
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.145
country_id: 3469034
description:
Jan 25 06:42:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.122
country_id: 3175395
description:
Jan 25 06:42:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.226.154.124
country_id: 3469034
description:
Jan 25 06:42:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.226.154.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.175
country_id: 732800
description:
Jan 25 06:42:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.226.154.124
country_id: 3469034
description:
Jan 25 06:43:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.226.154.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.138.60
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/number/141/242150 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.49.146
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-46.198.145.49.146||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 06:47:24 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63463: 535 Incorrect authentication data (set_id=alexandr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 06:47:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.99.74.247
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maennchen/zipstream-php/test/BigintTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.161.146.46
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=3087 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.25.239.39
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=73301515047031 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.0.95.215
country_id: 3508796
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=93811516691972 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 07:01:03 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:58335: 535 Incorrect authentication data (set_id=vm01)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 07:01:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.143.155.64
country_id: 102358
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/contact.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.159
country_id: 3865483
description:
Jan 25 07:03:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.133
country_id: 2510769
description:
Jan 25 07:03:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.239
country_id: 690791
description:
Jan 25 07:03:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 73.130.145.198
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/35-lang-normalize.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.133
country_id: 2510769
description:
Jan 25 07:03:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.78
country_id: 3469034
description:
Jan 25 07:04:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.171.157
country_id: 3923057
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteSurfaceChart1.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.3.24.69
country_id: 1269750
description:
Jan 25 07:12:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.3.24.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
country_id: 1835841
description:
Jan 25 07:13:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.89.94.7
country_id: 192950
description:
Jan 25 07:13:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.89.94.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.168
country_id: 1269750
description:
Jan 25 07:13:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 07:14:12 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.89.94.7
country_id: 192950
description:
Jan 25 07:14:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.89.94.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 07:14:14 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60532: 535 Incorrect authentication data (set_id=testing3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.216.143
country_id: 298795
description:
Jan 25 07:16:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.216.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jan 25 07:16:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2026-01-25 07:16:02 dovecot_login authenticator failed for H=([31.141.216.143]) [31.141.216.143]:53124: 535 Incorrect authentication data (set_id=sales@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.48.12
country_id: 1562822
domain: vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vc-b.com.my/images/son.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.83.101.114
country_id: 2245662
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Foundation HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.70.109.7
country_id: 289688
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Foundation/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.249
country_id: 6252001
description:
Jan 25 07:23:50 sv3 pure-ftpd[3642853]: (?@198.235.24.249) [INFO] New connection from 198.235.24.249


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.136.132
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/about.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.120.46.79
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=73401515569897 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 07:27:58 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57559: 535 Incorrect authentication data (set_id=saundra)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 07:27:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.104.207
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-32.146.103.104.207||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.132.85
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/press.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.134
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-38.92.71.74.134||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.213.184
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=85611515979972 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 07:41:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 07:41:06 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56461: 535 Incorrect authentication data (set_id=ea)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.82.78.195
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/AbstractTestSessionListener.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.171.169
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=23 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 07:53:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 174.66.50.72
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/10-sub-pixel-bgr.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.101.120
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=87 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 07:54:24 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 07:54:26 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61585: 535 Incorrect authentication data (set_id=velenje)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.71.45.187
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/event-dispatcher/Tests/ImmutableEventDispatcherTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.87.82
country_id: 1562822
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/services.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.230.43.8
country_id: 3489940
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/1191009474.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.1.19.187
country_id: 6252001
description:
[2026-01-25 08:05:39 +0800] info [webmaild] 34.1.19.187 - - "GET /ads.txt HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 08:08:11 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60394: 535 Incorrect authentication data (set_id=sz)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 08:08:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.114.255
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-includes/css/dist/block-library/style.min.css?ver=6.9 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.208.141.147
country_id: 2245662
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.117.235.16
country_id: 2510769
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=10.4.3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.53.231.232
country_id: 1527747
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.12.1 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.86.224
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/plugins/jetpack/jetpack_vendor/automattic/woocommerce-analytics/build/956.js?minify=false&ver=409e67b93e15d69e7918 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.95.114.136
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/plugins/woocommerce-menu-bar-cart/assets/css/wpmenucart-main.min.css?ver=2.14.12 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.208.15.92
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/contact-form-7-main.min.css?ver=4.12.1 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 08:21:17 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 08:21:19 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:53448: 535 Incorrect authentication data (set_id=laposte)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.12
country_id: 2328926
description:
Jan 25 08:27:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-25 08:27:24 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:47312: 535 Incorrect authentication data (set_id=promo@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.23.168
country_id: 1814991
description:
Jan 25 08:29:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.23.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-25 08:29:05 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:57816: 535 Incorrect authentication data (set_id=promo@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.222.49
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=81&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.55
country_id: 6252001
description:
2026-01-25  8:30:24 684806 [Warning] Aborted connection 684806 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.55' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.202
country_id: 3469034
description:
Jan 25 08:34:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 08:34:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.237
country_id: 3469034
description:
Jan 25 08:34:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 08:34:52 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56661: 535 Incorrect authentication data (set_id=pl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/images/press.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.239.40.180
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 91.238.181.93
country_id: 3017382
description:
2026-01-25  8:44:52 685377 [Warning] Aborted connection 685377 to db: 'unconnected' user: 'unauthenticated' host: '91.238.181.93' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.176.30
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=208488 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 08:48:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 08:48:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:65502: 535 Incorrect authentication data (set_id=bender)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.158
description:
2026-01-25  8:51:37 685611 [Warning] Aborted connection 685611 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.158' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.158
description:
2026-01-25  8:55:21 685782 [Warning] Aborted connection 685782 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.249.52.227
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-58.104.249.52.227||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.162.57.109
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=28901516696291 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 09:01:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 09:01:34 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61350: 535 Incorrect authentication data (set_id=monomono)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.187.161
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=457703 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.227.192
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97051516695307 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.173.161
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/Backup/contact.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.29.238.66
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/routing/Matcher/RedirectableUrlMatcherInterface.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.222
country_id: 1269750
description:
Jan 25 09:11:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-25 09:11:28 dovecot_login authenticator failed for H=([122.187.230.222]) [122.187.230.222]:50457: 535 Incorrect authentication data (set_id=alert@kimmark.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.140.217.21
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-13.158.140.217.21||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 09:14:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:50476: 535 Incorrect authentication data (set_id=tss)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.210.246.54
country_id: 289688
description:
Jan 25 09:14:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.210.246.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2026-01-25 09:14:54 dovecot_login authenticator failed for H=([37.210.246.54]) [37.210.246.54]:54926: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 09:14:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 09:14:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.135.241.146
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Products 061-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.135.241.146
country_id: 6252001
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Products 061-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.182.130.10
country_id: 6252001
description:
2026-01-25  9:19:55 686805 [Warning] Aborted connection 686805 to db: 'unconnected' user: 'unauthenticated' host: '147.182.130.10' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/keyword/images/home/csr.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 09:27:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:52120: 535 Incorrect authentication data (set_id=romario)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.78.146
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/Loader/ArrayLoader.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.130
country_id: 1269750
description:
Jan 25 09:30:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-01-25 09:30:56 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:55602: 535 Incorrect authentication data (set_id=no-reply@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.59.213.100
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/generator/FactoryFile.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.168.232
country_id: 1562822
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/customers.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-25 09:35:07 H=([77.83.39.167]) [77.83.39.167]:59290 F=<stevenwelboun@op.pl> rejected RCPT <cky@ahfengineering.com>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.52.147.182
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=61961516695189 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.189.36.171
country_id: 3895114
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88931514863850 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.187.198.163
country_id: 1562822
description:
2026-01-25 09:37:03 dovecot_login authenticator failed for H=(213.5.130.152) [113.187.198.163]:37314: 535 Incorrect authentication data (set_id=hadzrizan@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.134.181.38
country_id: 1880251
description:
2026-01-25 09:37:36 dovecot_login authenticator failed for H=(190.2.145.187) [43.134.181.38]:37624: 535 Incorrect authentication data (set_id=nurhayat@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 09:41:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 09:41:12 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:58744: 535 Incorrect authentication data (set_id=yamasaki)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.58.201
country_id: 1210997
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/hotel.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.66.132
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=993425 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.36.4
country_id: 3469034
description:
[2026-01-25 09:46:26 +0800] info [cpaneld] 181.189.36.4 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.183.86
country_id: 3469034
description:
Jan 25 09:47:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.183.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.26
country_id: 798544
description:
Jan 25 09:48:17 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.183.86
country_id: 3469034
description:
Jan 25 09:48:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.183.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 09:54:29 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 09:54:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:64379: 535 Incorrect authentication data (set_id=vladimir)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-25 10:00:01 H=([127.0.0.1]) [103.197.57.71]:49822 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.153.215.83
country_id: 146669
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/OPP Tape 1-1-250x250.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.153.215.83
country_id: 146669
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/OPP Tape 1-1-250x250.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 25 10:06:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 10:07:24 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 10:07:26 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:54001: 535 Incorrect authentication data (set_id=brandon)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.151.13.55
country_id: 1814991
description:
Jan 25 10:08:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.151.13.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.151.13.55
country_id: 1814991
description:
2026-01-25 10:08:34 dovecot_login authenticator failed for H=([27.151.13.55]) [27.151.13.55]:39824: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/plug/sms/img/index.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 25 10:10:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Jan 25 10:11:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-25 10:11:58 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:42900: 535 Incorrect authentication data (set_id=partners@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.90.153.179
country_id: 3469034
domain: www.tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tschuan.com/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.33.79
country_id: 1819730
description:
Jan 25 10:15:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.33.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2026-01-25 10:15:17 dovecot_login authenticator failed for H=079.33.246.220.static.netvigator.com [220.246.33.79]:49631: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 10:16:24 H=([45.144.212.242]) [45.144.212.242]:64156 F=<no_reply@admin.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:16:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:16:38 dovecot_login authenticator failed for H=(5q2ei4Fj) [77.83.39.224]:57318: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:17:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:17:15 dovecot_login authenticator failed for H=(NVugqE7Zm7) [77.83.39.224]:61483: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:18:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:18:10 dovecot_login authenticator failed for H=(8QC4Arn) [77.83.39.224]:52257: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:19:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:19:07 dovecot_login authenticator failed for H=(eEmS82) [77.83.39.224]:52724: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.72.175
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=594602 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:20:21 dovecot_login authenticator failed for H=(4ysC2z) [77.83.39.224]:63389: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 10:20:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 10:20:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61302: 535 Incorrect authentication data (set_id=tmn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:20:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:20:03 dovecot_login authenticator failed for H=(CPeLmemYz) [77.83.39.224]:49949: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:21:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:21:17 dovecot_login authenticator failed for H=(Fq1yaE) [77.83.39.224]:60579: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:22:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:22:13 dovecot_login authenticator failed for H=(rYlNm9k) [77.83.39.224]:54255: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:23:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:23:09 dovecot_login authenticator failed for H=(0g6PQl) [77.83.39.224]:56643: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:23:15 dovecot_login authenticator failed for H=(B5t1Neu) [77.83.39.224]:54011: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.187.130
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/photos/img/photos/img/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:24:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:24:04 dovecot_login authenticator failed for H=(skR1ntWt6) [77.83.39.224]:62261: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:25:00 dovecot_login authenticator failed for H=(bWYpqYUUL) [77.83.39.224]:65290: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:25:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:25:18 dovecot_login authenticator failed for H=(WIRBMtgB) [77.83.39.224]:49907: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:26:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:26:03 dovecot_login authenticator failed for H=(WOX6xeDUXX) [77.83.39.224]:60441: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.108.227
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=656790 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:26:59 dovecot_login authenticator failed for H=(aHCOdJtgGh) [77.83.39.224]:57952: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:27:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:27:29 dovecot_login authenticator failed for H=(4BvDDoUcbD) [77.83.39.224]:52675: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:28:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:28:07 dovecot_login authenticator failed for H=(qOR4E6Gr) [77.83.39.224]:53155: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:29:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:29:03 dovecot_login authenticator failed for H=(BXWNCi) [77.83.39.224]:51923: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:29:40 dovecot_login authenticator failed for H=(y49qUxNE) [77.83.39.224]:57194: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:30:07 dovecot_login authenticator failed for H=(e0V1IJC) [77.83.39.224]:58065: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:30:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:31:50 dovecot_login authenticator failed for H=(xOOcliAfg) [77.83.39.224]:64090: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:31:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:31:02 dovecot_login authenticator failed for H=(0Cpm1kRF) [77.83.39.224]:50339: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Jan 25 10:31:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-25 10:31:09 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:54288: 535 Incorrect authentication data (set_id=partners@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:32:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:32:08 dovecot_login authenticator failed for H=(xlzFvxs8) [77.83.39.224]:49519: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:33:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:33:05 dovecot_login authenticator failed for H=(ESYVvW9j) [77.83.39.224]:55338: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 10:33:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 10:33:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63015: 535 Incorrect authentication data (set_id=titans)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:33:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:34:01 dovecot_login authenticator failed for H=(MdDdkK) [77.83.39.224]:62600: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:34:08 dovecot_login authenticator failed for H=(rhoSqONsVv) [77.83.39.224]:55545: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.74.230.176
country_id: 1210997
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/listing-details.php?id=84605649 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 10:35:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:35:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:35:04 dovecot_login authenticator failed for H=(HywWJSfc) [77.83.39.224]:57663: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.238.82
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-35.108.165.238.82||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:36:00 dovecot_login authenticator failed for H=(WtsPsYKkk) [77.83.39.224]:57226: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:36:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:36:13 dovecot_login authenticator failed for H=(YozchmB) [77.83.39.224]:58802: 535 Incorrect authentication data (set_id=bktan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.172.144
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/stamp/37/462682 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:37:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:37:09 dovecot_login authenticator failed for H=(n4wgbJKQL) [77.83.39.224]:63130: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:38:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:38:05 dovecot_login authenticator failed for H=(kTXMks) [77.83.39.224]:55099: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:38:24 dovecot_login authenticator failed for H=(oYoSOFh0OF) [77.83.39.224]:57258: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 152.32.188.207
country_id: 1819730
description:
2026-01-25 10:38:46 689815 [Warning] Aborted connection 689815 to db: 'unconnected' user: 'unauthenticated' host: '152.32.188.207' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.247.127.249
country_id: 3865483
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/paving-breaker.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:39:01 dovecot_login authenticator failed for H=(aYh6u2) [77.83.39.224]:52099: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:39:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:40:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:40:03 dovecot_login authenticator failed for H=(IlqB96YD) [77.83.39.224]:56432: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:40:35 dovecot_login authenticator failed for H=(ADZiS5zw) [77.83.39.224]:55110: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:41:01 dovecot_login authenticator failed for H=(ftMMD7W) [77.83.39.224]:52914: 535 Incorrect authentication data (set_id=bwyou.vpb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:41:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.144.68
country_id: 2017370
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/images/ourmarkets_001.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 10:47:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 10:47:18 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:50860: 535 Incorrect authentication data (set_id=sac)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/plug/sms/img/img/product.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.227.166.67
country_id: 3469034
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=744397 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.183.19.156
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=365736 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/X11/xorg.conf.d/00-keyboard.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/alsa/conf.d/50-pipewire.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.82.131.252
country_id: 3469034
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/capability.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/access_checker.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/php.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.modules.d/105_mod_authz_user.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.modules.d/420_mod_socache_shmcb.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 11:00:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 11:00:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63010: 535 Incorrect authentication data (set_id=eu-de)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.32.75
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-01.168.91.32.75||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.54.7
country_id: 1562822
domain: u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/u-net.com.my/products HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/cagefs/conf.d/ai-bolit.cfg||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/cl.selector/php.extensions.d/i360.cfg||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.105.248.218
country_id: 6252001
description:
Jan 25 11:11:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.105.248.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-25 11:11:09 dovecot_plain authenticator failed for H=(promendal) [24.105.248.218]:46866: 535 Incorrect authentication data (set_id=muhdfauzan@ajplantations.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/crypto-policies/back-ends/bind.config||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/crypto-policies/back-ends/nss.config||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.250.201.45
country_id: 3469034
description:
Jan 25 11:12:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.250.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.216
country_id: 953987
description:
Jan 25 11:12:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.1.245.106
country_id: 3865483
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/resize.php?h=463&img=img/product_photos/942456.jpg&w=555 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 11:13:47 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 11:13:49 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:54121: 535 Incorrect authentication data (set_id=autumn)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/crypto-policies/local.d/nss-p11-kit.config||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.129.105.50
country_id: 1814991
description:
Jan 25 11:14:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.129.105.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.105.50
country_id: 1814991
description:
2026-01-25 11:14:40 dovecot_login authenticator failed for H=([219.129.105.50]) [219.129.105.50]:49509: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dbus-1/system.d/org.freedesktop.Flatpak.SystemHelper.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.215
country_id: 3469034
description:
Jan 25 11:16:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.87.74
country_id: 3469034
description:
Jan 25 11:16:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.87.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.1.77
country_id: 953987
description:
Jan 25 11:16:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.1.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.237
country_id: 933860
description:
Jan 25 11:16:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.208.250.102
country_id: 3469034
description:
Jan 25 11:16:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.208.250.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.70.75.10
country_id: 3469034
description:
Jan 25 11:16:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.70.75.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.241
country_id: 3175395
description:
Jan 25 11:16:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.58
country_id: 298795
description:
Jan 25 11:16:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.230.250
country_id: 798544
description:
Jan 25 11:16:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.230.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.45.167.121
country_id: 2510769
description:
Jan 25 11:16:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.45.167.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.47
country_id: 3469034
description:
Jan 25 11:16:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.215
country_id: 3469034
description:
Jan 25 11:17:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.70.75.10
country_id: 3469034
description:
Jan 25 11:17:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.70.75.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.177.105
country_id: 3469034
description:
Jan 25 11:17:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.177.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.230.250
country_id: 798544
description:
Jan 25 11:17:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.230.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.58
country_id: 298795
description:
Jan 25 11:17:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.1.77
country_id: 953987
description:
Jan 25 11:17:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.1.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.88
country_id: 690791
description:
Jan 25 11:17:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.241
country_id: 3175395
description:
Jan 25 11:17:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.87.74
country_id: 3469034
description:
Jan 25 11:17:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.87.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 204.144.187.196
country_id: 6252001
description:
Jan 25 11:18:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 204.144.187.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.144.187.196
country_id: 6252001
description:
2026-01-25 11:18:20 dovecot_plain authenticator failed for H=(lamproa) [204.144.187.196]:49162: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.113.228
country_id: 1210997
description:
Jan 25 11:19:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.113.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.113.228
country_id: 1210997
description:
2026-01-25 11:19:50 dovecot_plain authenticator failed for H=(1J0G627F) [103.145.113.228]:51523: 535 Incorrect authentication data (set_id=facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dnf/plugins/copr.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dnf/protected.d/grub2-tools-minimal.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.212.228
country_id: 294640
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/global-state/src/CodeExporter.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.12
country_id: 732800
description:
Jan 25 11:26:19 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.18
country_id: 1269750
description:
Jan 25 11:26:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 11:26:47 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 11:26:49 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62413: 535 Incorrect authentication data (set_id=toml)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/fonts/conf.d/10-hinting-slight.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.6.87
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/event-dispatcher/Tests/EventTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/fonts/conf.d/48-spacing.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/fonts/conf.d/61-urw-nimbus-sans.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/gss/mech.d/gssproxy.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/imunify360-webshield/captcha/lang.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/imunify360-webshield/webshield-http.conf.d/resolver.conf||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 66.180.131.196
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-38.66.180.131.196||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 11:40:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 11:40:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62321: 535 Incorrect authentication data (set_id=constanta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.63.31
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88451514882760 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.111.227.152
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12581514861377 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/libreport/events.d/collect_dnf.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.41.231
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=899701 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.180
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-49.198.145.50.180||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/pftfood/access-logs/pftfood.com||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.25.50.14
country_id: 3932488
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/nikic/php-parser/lib/bootstrap.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 11:53:20 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:51980: 535 Incorrect authentication data (set_id=user001)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 11:53:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.200.114.248
country_id: 2589581
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/img-sys/powered_by_cpanel.svg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.123.150.170
country_id: 3865483
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/img-sys/server_misconfigured.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.71.208
country_id: 1562822
domain: af-sb.comhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.comhttp/af-sb.com/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/pftfood/etc/pftfood.rcube.db||User:pftfood||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 11:57:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/pftfood/ssl/ssl.db||User:pftfood||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.48.95.101
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/11documentsecurity-xls.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.244.174
country_id: 3625428
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27331514528878 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 12:06:51 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:52156: 535 Incorrect authentication data (set_id=amalia)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 12:06:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
country_id: 1814991
description:
Jan 25 12:08:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-01-25 12:08:29 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:53772: 535 Incorrect authentication data (set_id=careers@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.39.82
country_id: 1814991
description:
Jan 25 12:09:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.39.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-01-25 12:09:09 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:39823: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.201
country_id: 6252001
description:
Jan 25 12:09:54 sv3 pure-ftpd[3821469]: (?@91.230.168.201) [INFO] New connection from 91.230.168.201


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.111
country_id: 6252001
description:
Jan 25 12:09:54 sv3 pure-ftpd[3821471]: (?@91.230.168.111) [INFO] New connection from 91.230.168.111


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.57.171.147
country_id: 3895114
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/index.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 181.117.137.189
country_id: 3865483
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/65-fonts-persian.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.55.192
country_id: 3865483
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/smart.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.199.80.113
country_id: 6252001
description:
2026-01-25 12:14:08 693378 [Warning] Aborted connection 693378 to db: 'unconnected' user: 'unauthenticated' host: '198.199.80.113' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.120.129.7
country_id: 690791
description:
Jan 25 12:18:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.120.129.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.233
country_id: 2300660
description:
Jan 25 12:18:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 12:20:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 12:20:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:51851: 535 Incorrect authentication data (set_id=104)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.110.251.37
country_id: 1269750
domain: maalloys.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:23227.maalloys.com.my||ServerName:maalloys.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:541b25d14ff044c1972ed07faeead37985fb07fb||Title:0xc3d775dc||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.107.134.161
country_id: 2464461
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/278855.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/asia/images/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.143.93
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=87911523583434 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.115.226.120
country_id: 2782113
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88061522226299 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.87.251.155
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=211364 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 12:33:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 12:33:29 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:58256: 535 Incorrect authentication data (set_id=pac)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.223.76.27
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=37401514884338 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 12:33:46 H=([45.144.212.242]) [45.144.212.242]:55480 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.144.68
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=46061514946811 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.201.234.171
country_id: 3469034
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/quality.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pcp/derived/cpu-util.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.68.10.126
country_id: 3686110
domain: aaa.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aaa.krisfood.com/product-category.php?id=3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pki/ca-trust/ca-legacy.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pki/nssdb/cert9.db||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.171.102.224
country_id: 1733045
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=24461515983341 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 12:45:15 H=([45.144.212.242]) [45.144.212.242]:60465 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.239.238.50
country_id: 6252001
domain: manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 12:46:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 12:46:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62883: 535 Incorrect authentication data (set_id=cong)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 12:47:19 H=([45.144.212.242]) [45.144.212.242]:54154 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.164.34.142
country_id: 3469034
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/admin/assets/ashrae.pdf HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.195.83
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.174.62
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-25 12:50:45 H=([31.145.189.54]) [31.145.189.54]:60296 F=<dse_NA2@docusign.net> rejected RCPT <fkr@fkr.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.145.6.15
country_id: 3996063
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/history.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.123.62
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/facilities.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-25 12:57:47 H=([31.145.189.54]) [31.145.189.54]:56555 F=<dse_NA2@docusign.net> rejected RCPT <sales@cordage.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/limits.d/25-pw-rlimits.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.0.102.109
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=19 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/selinux/targeted/setrans.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 13:00:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 13:00:15 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:59733: 535 Incorrect authentication data (set_id=chou)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.139.74.246
country_id: 3865483
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=33&sub=90 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70081.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3a0534817ee105cb5cef7b539b38f5f0924ae998||Title:0x3607aeb4||RSV:7.67||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/ssh/ssh_config.d/50-redhat.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.232.224.186
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2300 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c5f97e63f07f497dff90c49889e3a3405462df87||Title:0x1d1e9f14||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sw-engine/pool.d/default.conf||User:root||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3dc75861a4826c4974c058cbf6e4ee6ca3815f42||Title:0xd1328928||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.37.118.179
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-07.198.37.118.179||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sysconfig/imunify360/custom_billing.config||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sysconfig/kcare/kcare.conf||User:root||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:44a1073ae57805ce7b4cee4a41a0bf98d41337f3||Title:0xb5d3cdf0||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:992a27fb13885ccb1a1839d0681bd2f6cfeed12e||Title:0x65c220bb||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b2497167e2d0b755315ed584814adb1b365d0292||Title:0x6369f56c||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 13:14:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 13:14:27 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60298: 535 Incorrect authentication data (set_id=wilson)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
country_id: 1814991
description:
Jan 25 13:17:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.235.176.220
country_id: 102358
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=913007 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 13:21:29 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.223.188.55
country_id: 798544
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-22.31.223.188.55||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/yum/pluginconf.d/copr.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/yum/pluginconf.d/universal_hooks.conf||User:root||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.72
country_id: 6252001
description:
2026-01-25 13:23:57 695256 [Warning] Aborted connection 695256 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.72' (This connection closed normally without authentication)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: maalloys.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/115.0.5790.102 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
country_id: 1819730
description:
Jan 25 13:27:17 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-25 13:27:19 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:33114: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 13:28:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 13:28:30 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:55978: 535 Incorrect authentication data (set_id=postmasters)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/dracut/dracut.conf.d/01-dist.conf||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.76
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-33.198.145.50.76||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.185.130
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=124214 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.48.206.40
country_id: 1269750
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/projects.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.253.247
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=697884 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 13:42:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 13:42:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57496: 535 Incorrect authentication data (set_id=juhua)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.121.7
country_id: 6252001
description:
2026-01-25 13:43:48 695851 [Warning] Aborted connection 695851 to db: 'unconnected' user: 'unauthenticated' host: '159.223.121.7' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.123.6
country_id: 1733045
description:
[2026-01-25 13:45:48 +0800] info [webmaild] 113.211.123.6 - s-osada@mckd.com.my "GET /cpsess9153182787/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.14.217.69
country_id: 3625428
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/nonStringKeys.yml HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 13:48:22 H=([45.144.212.242]) [45.144.212.242]:55875 F=<no_reply@admin.com> rejected RCPT <joseph@symphony-led.com>: Sender verify failed


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.88.111.251
country_id: 2328926
domain: astlog.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:102.88.111.251||TA:102.88.111.251||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.45.165
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=233781 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 13:56:12 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 13:56:14 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:53404: 535 Incorrect authentication data (set_id=rancho)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 14:09:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 14:09:58 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:51504: 535 Incorrect authentication data (set_id=elens)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 15.235.114.75
country_id: 6251999
domain: kendek.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/keyword/img/druma_photos/team.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.214
country_id: 3077311
description:
Jan 25 14:15:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.214
country_id: 3077311
description:
2026-01-25 14:15:28 dovecot_plain authenticator failed for H=([10.26.18.10]) [212.102.39.214]:25030: 535 Incorrect authentication data (set_id=samsudeen.ganny@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.164.103.67
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/video.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.214
country_id: 3077311
description:
Jan 25 14:16:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.214
country_id: 3077311
description:
2026-01-25 14:16:00 dovecot_login authenticator failed for H=([10.26.18.10]) [212.102.39.214]:42400: 535 Incorrect authentication data (set_id=samsudeen.ganny@ajplantations.com.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.249.128.75
country_id: 2963597
domain: smartcable.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.19.27
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=44501516696477 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 14:24:11 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:59000: 535 Incorrect authentication data (set_id=p6)


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 146.70.22.246
country_id: 2510769
domain: thinkcloud.com.my
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:1') and 1=1 union all select 1,null,'<script>alert(\"xss\")</etc/passwd')#||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 146.70.22.246
country_id: 2510769
domain: thinkcloud.com.my
description:
IM360 WAF: Possible XSS in arguments||MV:1') and 1=1 union all select 1,null,'<script>alert(\"xss\")</script>',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77318026
name: IM360 WAF: Suspicious input like SQLi
abuser: 146.70.22.246
country_id: 2510769
domain: thinkcloud.com.my
description:
IM360 WAF: Suspicious input like SQLi||MVN:ARGS:id||MV:1/**//**/or/**/gtid_subset(concat(0x31787549,(select/**/(elt(2836=2836,1))),0x7044494c),6420)||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 146.70.22.246
country_id: 2510769
domain: thinkcloud.com.my
description:
IM360 WAF: PHP Injection Low value||MV:1/**//**/AND/**/EXP(~(SELECT/**/*/**/FROM/**/(SELECT/**/CONCAT(0x506c4334,(SELECT/**/(ELT(2836=2836,1))),0x34573737))x))||MVN:ARGS:id||RSV:7.67||T:APACHE||SC:/home2/thinkcloudadmin/public_html/resources-details.php||


plugin: modsec
rule: 77211700
name: IM360 WAF: Detects conditional SQL injection attempts
abuser: 146.70.22.246
country_id: 2510769
domain: thinkcloud.com.my
description:
IM360 WAF: Detects conditional SQL injection attempts||RSV:7.67||T:APACHE||MVN:MATCHED_VAR||MV:1/**//**/AND/**/1/**/GROUP/**/BY/**/CONCAT(0x66665474,(SELECT/**/(ELT(2836=2836,1))),0x726c4269,FLOOR(RAND(0)*2))/**/HAVING/**/MIN(0)#||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 14:24:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 146.70.22.246
country_id: 2510769
domain: thinkcloud.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1') AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 146.70.22.246
country_id: 2510769
domain: thinkcloud.com.my
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:1') AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.196.171.213
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Mix-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.196.171.213
country_id: 1880251
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Mix-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/dRuma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
country_id: 1835841
description:
Jan 25 14:28:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
country_id: 1814991
description:
Jan 25 14:29:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.35
country_id: 1269750
description:
Jan 25 14:30:19 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.35.98
country_id: 6252001
domain: www.snymetalstamping.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:14-32.104.207.35.98||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.41.72
country_id: 3469034
description:
Jan 25 14:34:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.41.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.200.208
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-35.171.224.200.208||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.205.221
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-36.171.224.205.221||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 14:37:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 14:37:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62627: 535 Incorrect authentication data (set_id=hirotada)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.42.213.197
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-43.89.42.213.197||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 14:47:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.204.214
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-48.171.224.204.214||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 14:51:33 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 14:51:35 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:64358: 535 Incorrect authentication data (set_id=sort)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.231.35.156
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Tests/Tester/ApplicationTesterTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.197.167
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=103827 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 15:05:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 15:05:33 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:53472: 535 Incorrect authentication data (set_id=scheidt)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 184.174.27.45
country_id: 6252001
domain: www.plomalite.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:15-07.184.174.27.45||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.116.96.170
country_id: 3895114
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/ResponseHeaderBagTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.72.57.94
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/tr HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.94.130.170
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/tr/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.107.124.202
country_id: 3686110
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/IpUtilsTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 15:19:14 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 15:19:16 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:50688: 535 Incorrect authentication data (set_id=helper)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.14.177.176
country_id: 6252001
domain: 34.219.81.247
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.219.81.247/azenv4.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.51.106
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-21.198.145.51.106||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-25 15:21:23 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:53628: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-25 15:24:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:64007: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.161.248.236
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/teamwork.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-25 15:26:52 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:62393: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.73.125
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/js/contact-form.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.217
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/js/elevateZoom-3.0.8.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.149
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/js/countdown.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.79
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/js/scrollUp.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.169.43
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/js/main.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.13.139.130
country_id: 1733045
description:
2026-01-25 15:27:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [124.13.139.130]:62395: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.168.174
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/js/vendor/bootstrap.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.73.140
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/js/owl.carousel.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.171.82
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/js/asRange.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.200
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/js/jquery-parallax.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.219
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/js/pagination.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.4
country_id: 2635167
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/js/custom.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-25 15:28:51 H=(localhost.localdomain) [78.153.140.207]:42730 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.77.58
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-30.92.71.77.58||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 15:33:37 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 15:33:39 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:64362: 535 Incorrect authentication data (set_id=chat1)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/kdump/dracut.conf.d/99-kdump.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.169.196.215
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/introduceisland/19/299/1933464 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.205.249.98
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=68801516692701 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.15.169
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=73681523583000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.70.179.107
country_id: 2635167
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:15-45.146.70.179.107||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 15:47:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 15:47:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57500: 535 Incorrect authentication data (set_id=banners)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.104.207
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-54.146.103.104.207||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.95.54.132
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/photos/img/photos/img/contact-us.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.95.124
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=81951514942118 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 16:01:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 16:01:36 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60055: 535 Incorrect authentication data (set_id=nub)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.161
country_id: 732800
description:
Jan 25 16:04:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.24
country_id: 1269750
description:
Jan 25 16:12:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.24
country_id: 1269750
description:
Jan 25 16:13:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 16:14:19 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 16:15:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 16:15:58 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56819: 535 Incorrect authentication data (set_id=redmine)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.104.93
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/wp/wp-content/uploads/ROSENANAI.pdf HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 164.163.142.39
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34481516693158 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 182.96.164.74
country_id: 1814991
domain: www.manforce.net
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/data/mysql_error_trace.inc||User:manfotp3||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 16:29:21 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 16:29:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57602: 535 Incorrect authentication data (set_id=commission)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.136.7.211
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=33 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.120.167.238
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14891515376488 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.224.7
country_id: 248816
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/food/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.159.215.230
country_id: 192950
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/food/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.62.3
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/food/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.165.237.75
country_id: 1168579
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/food/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.50.179.217
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/food/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.50.11.29
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/food/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 16:43:16 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:64114: 535 Incorrect authentication data (set_id=ie)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/rpm/redhat/redhat-hardened-clang.cfg||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 16:43:14 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.200.212.163
country_id: 783754
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/mssa/index.php/activities/mssa-5th-council-meeting/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.196.28.246
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=83291516687616 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.142.73.116
country_id: 2017370
domain: lvconsult.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:16-55.91.142.73.116||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 199.34.87.3
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-56.199.34.87.3||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.10.20
country_id: 1814991
description:
Jan 25 16:58:02 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.10.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
country_id: 1814991
description:
2026-01-25 16:58:04 dovecot_login authenticator failed for H=([221.10.10.20]) [221.10.10.20]:56267: 535 Incorrect authentication data (set_id=accounting@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 10.1.14.100
description:
[2026-01-25 16:58:54 +0800] info [whostmgrd] 10.1.14.100 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.226.75.167
country_id: 2921044
description:
2026-01-25 16:58:07 705059 [Warning] Aborted connection 705059 to db: 'unconnected' user: 'unauthenticated' host: '64.226.75.167' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 16:58:41 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 16:58:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:64755: 535 Incorrect authentication data (set_id=hannibal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.56.235.9
country_id: 285570
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7156664533.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.104.207
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-02.146.103.104.207||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 178.20.47.39
country_id: 2017370
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:17-06.178.20.47.39||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.42.140
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-07.142.111.42.140||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.225.87.105
country_id: 1814991
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/until/401/293263 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.0.7.227
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/maennchen/zipstream-php/phpunit.xml.dist HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 25 17:09:20 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-25 17:09:22 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:59720: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.210.204
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=226839 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.204.150
country_id: 2413451
description:
2026-01-25 17:11:44 dovecot_login authenticator failed for H=([197.255.204.150]) [197.255.204.150]:36654: 535 Incorrect authentication data (set_id=accounting@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.204.150
country_id: 2413451
description:
Jan 25 17:11:42 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.204.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.244
country_id: 298795
description:
Jan 25 17:13:25 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.37.123.196
country_id: 2963597
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&page_id=4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.146
country_id: 3469034
description:
Jan 25 17:14:01 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.172.54
country_id: 3469034
description:
Jan 25 17:14:11 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.172.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 17:15:45 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 17:15:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56379: 535 Incorrect authentication data (set_id=s103)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.113.36
country_id: 3658394
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/news-detail8.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.76.240
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-16.92.71.76.240||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.34.96
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/sv HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.166.205.27
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/sv/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.196.154.144
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/css-selector/Tests/Parser/Handler HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.97.26.76
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/css-selector/Tests/Parser/Handler/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.60.77.128
country_id: 6252001
description:
Jan 25 17:24:48 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.60.77.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-01-25 17:24:50 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (iratesse) [68.60.77.128]:47430: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.218
country_id: 2300660
description:
Jan 25 17:24:17 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.217.171
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=28831514526532 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 17:31:28 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 17:31:30 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57068: 535 Incorrect authentication data (set_id=user_id)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.20.57.96
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=8 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.42.144
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=21 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.195.173
country_id: 3865483
description:
Jan 25 17:43:49 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.195.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 17:43:19 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.122.65
country_id: 798544
description:
Jan 25 17:44:12 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.122.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.202
country_id: 2510769
description:
Jan 25 17:44:13 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.195.173
country_id: 3865483
description:
Jan 25 17:44:04 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.195.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.239.45.10
country_id: 1269750
description:
Jan 25 17:45:53 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.239.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.239.45.10
country_id: 1269750
description:
Jan 25 17:46:00 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.239.45.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.75.125
country_id: 1562822
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/index.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 17:47:44 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 17:47:46 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60609: 535 Incorrect authentication data (set_id=office2)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.8.36
country_id: 6252001
description:
[2026-01-25 17:47:29 +0800] info [cpaneld] 65.111.8.36 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.93.11
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/sfMergeKey.yml HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.86.163.150
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=49351514514756 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.28.13
country_id: 1819730
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Others/Mix-500x500-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.28.13
country_id: 1819730
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Others/Mix-500x500-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib64/gconv/gconv-modules.d/gconv-modules-extra.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.176.211
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=671968 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/opt/imunify360/venv/pyvenv.cfg||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.15.146.137
country_id: 3077311
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/see/11/123/1199618 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.79
country_id: 732800
description:
Jan 25 18:03:31 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 18:03:45 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 18:03:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62670: 535 Incorrect authentication data (set_id=motia)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.252
country_id: 2300660
description:
Jan 25 18:04:02 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.252 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.249
country_id: 1880251
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/application/themes/bishop/css/style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.228
country_id: 1880251
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/application/themes/bishop/fonts/biotif-regular-webfont.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.157
country_id: 1880251
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/application/themes/bishop/fonts/fontawesome/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib64/icu/67.1/Makefile.inc||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.92
country_id: 2510769
description:
Jan 25 18:04:26 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.92 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.226
country_id: 1880251
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/application/themes/bishop/css/all.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.153
country_id: 1880251
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/application/themes/bishop/fonts/biotif-bold-webfont.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.61.38
country_id: 1562822
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/resize.php?h=463&img=img/product_photos/169462.jpg&w=555 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.38.239.13
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=29 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.110.107.19
country_id: 2750405
domain: ahfengineering.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/ahfe3522/public_html/wp-includes/sodium_compat/autoload-php7.php||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 89.110.107.19
country_id: 2750405
domain: ahfengineering.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/ahfe3522/public_html/wp-includes/sodium_compat/lib/namespaced.php||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.3.20.54
country_id: 614540
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/js/modernizr.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.181.46
country_id: 953987
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/js/twitter.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.0.154.24
country_id: 3469034
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/js/ddsmoothmenu.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.148.199
country_id: 1562822
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/javascripts/libs/jquery.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.4.18.89
country_id: 3469034
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/stylesheets/main.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.44.1
country_id: 1210997
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/stylesheets/prettyPhoto.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.106.125.73
country_id: 783754
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/fonts/fonts.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.158.43
country_id: 99237
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/stylesheets/main-responsive.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.74.142.154
country_id: 3469034
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/stylesheets/owl.carousel.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.39.240
country_id: 3996063
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/stylesheets/owl.theme.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.171.250.120
country_id: 3865483
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/javascripts/libs/plugins.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.61.153
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=7222 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.36.214.93
country_id: 1269750
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.164.57.130
country_id: 1562822
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/fonts/font_icons/fontawesome-webfonte0a5.woff2?v=4.3.0 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.171.118.155
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=37 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.230.118.80
country_id: 3865483
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/career.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.30.87.215
country_id: 1562822
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/stylesheets/font-awesome.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.228.62.107
country_id: 1269750
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/javascripts/libs/modernizr.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.30.217
country_id: 1562822
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/stylesheets/animate.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.172.174.52
country_id: 3625428
domain: www.dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.dsc-expat.com/javascripts/custom/main.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 18:20:35 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 18:20:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57733: 535 Incorrect authentication data (set_id=shirley)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.177.78
country_id: 1269750
description:
Jan 25 18:25:48 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.177.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-01-25 18:25:50 dovecot_login authenticator failed for H=([182.95.177.78]) [182.95.177.78]:52442: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.144.198.202
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=48 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.47.172.253
country_id: 2287781
description:
Jan 25 18:28:57 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.47.172.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-25 18:28:59 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:35234: 535 Incorrect authentication data (set_id=subscribe@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/home/article.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.245.154.29
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57031514876853 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 176.123.1.159
country_id: 617790
domain: agsaintifik.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/125.0.6422.60 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 18:35:59 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 18:36:01 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:50532: 535 Incorrect authentication data (set_id=jons)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.54.25.143
country_id: 458258
description:
86.54.25.143 - - [25/Jan/2026:18:40:41 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12818839&pdata=https%253A%252F%252Fmail.tujusetia.my%253A2096%252Fcpsess1018431170%252F3rdparty%252Froundcube%252Findex.php&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769337640 HTTP/2.0" 302 0 mail.tujusetia.my "https://mail.tujusetia.my:2096/cpsess1018431170/3rdparty/roundcube/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.54.25.143


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.54.25.143
country_id: 458258
description:
[2026-01-25 18:40:44 +0800] info [webmaild] 86.54.25.143 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.187.90
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=738705 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 201.219.165.212
country_id: 3865483
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/61-urw-nimbus-sans.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.113.60.213
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=74 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.221.236
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603677 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.163.90.1
country_id: 690791
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34861516784099 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.227.105.148
country_id: 6252001
description:
2026-01-25 18:48:23 709254 [Warning] Aborted connection 709254 to db: 'unconnected' user: 'unauthenticated' host: '64.227.105.148' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 64.227.105.148
country_id: 6252001
description:
2026-01-25 18:48:26 709261 [Warning] Aborted connection 709261 to db: 'unconnected' user: 'unauthenticated' host: '64.227.105.148' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 102.165.53.3
country_id: 953987
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-49.102.165.53.3||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.166.183.138
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=541552 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 18:51:21 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 18:51:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61124: 535 Incorrect authentication data (set_id=hartmann)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.227.105.148
country_id: 6252001
description:
2026-01-25 18:53:27 709422 [Warning] Aborted connection 709422 to db: 'unconnected' user: 'unauthenticated' host: '64.227.105.148' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 64.227.105.148
country_id: 6252001
description:
2026-01-25 18:53:30 709431 [Warning] Aborted connection 709431 to db: 'unconnected' user: 'unauthenticated' host: '64.227.105.148' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.214.251
country_id: 1562822
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=961277 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.171.29
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=64781518079619 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.76.88
country_id: 3865483
domain: vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vc-b.com.my/new.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.51.46
country_id: 1562822
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/projects-references.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.20.128
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78291516783061 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/services.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 19:08:05 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 19:08:07 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:64503: 535 Incorrect authentication data (set_id=jmarin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.135.73
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=84871515980605 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 184.93.101.170
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-12.184.93.101.170||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 19:12:45 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.166.16.101
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=509827 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.7.36.233
country_id: 3865483
description:
2026-01-25 19:13:11 dovecot_login authenticator failed for H=(213.5.130.107) [38.7.36.233]:53908: 535 Incorrect authentication data (set_id=aoto@aoto.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.199.151.6
country_id: 192950
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/mockery/mockery/phpunit.xml.dist HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.160.142.87
country_id: 1820814
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=27 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.150.64.188
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/StubCaster.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.180.125.215
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=126580 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.114.254.10
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=124214 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 19:23:38 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 19:23:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63866: 535 Incorrect authentication data (set_id=imprime)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.165.187
country_id: 2017370
description:
Jan 25 19:24:01 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.165.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.165.187
country_id: 2017370
description:
2026-01-25 19:24:03 dovecot_login authenticator failed for H=([178.216.165.187]) [178.216.165.187]:47452: 535 Incorrect authentication data (set_id=autoreply@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.73.126
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=789818 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.244
country_id: 3469034
description:
Jan 25 19:29:18 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.183.74.177
country_id: 6252001
description:
Jan 25 19:29:46 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.183.74.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-25 19:29:48 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (andrecleic) [73.183.74.177]:42300: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.253
country_id: 953987
description:
Jan 25 19:29:49 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.253
country_id: 953987
description:
Jan 25 19:30:07 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.216
country_id: 3175395
description:
Jan 25 19:32:28 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.72.62
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/pipe-repair.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.14.245
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95111514512466 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.70.110
country_id: 1562822
domain: box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/box.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.70.110
country_id: 1562822
domain: box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/box.com.myhttp/box.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 19:39:54 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 19:39:56 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60761: 535 Incorrect authentication data (set_id=familie)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.97.63.199
country_id: 690791
domain: www.nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nmahir.com/index-3.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.115.182
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=3&sub=24 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.61.172.5
country_id: 285570
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=645854 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.228.186.45
country_id: 1269750
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=359598 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.98.130.52
country_id: 1282988
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=719898 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.77.97.194
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=147075 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 199.33.71.16
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=679911 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.117.127
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=360128 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.219.138.242
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=663533 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.132.122
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=4&page_id=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.42.75.8
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=31841514876951 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.171.127.202
country_id: 3624060
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=4&page_id=1&sub=3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.101.191
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=464199 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.103.164
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=715123 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.106.36.98
country_id: 783754
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/casual.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.25.4.12
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=456483 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.3.251
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=799623 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.248.64
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=762538 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.89.233
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=334061 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/contact.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.57.10
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=2&sub=27 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.2.38.145
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-52.50.2.38.145||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.224.98.153
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=17111514876132 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.12.178
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=635255 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.128.177
country_id: 2264397
description:
Jan 25 20:04:17 sv3 pure-ftpd[4106473]: (?@45.156.128.177) [INFO] New connection from 45.156.128.177


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-25 20:05:40 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59024: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 193.32.249.174
country_id: 2750405
domain: www.evergrown.com.my
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Web Downloader/6.9||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.205.77
country_id: 2413451
description:
2026-01-25 20:06:48 dovecot_login authenticator failed for H=(197-255-205-77.netpagedns.net) [197.255.205.77]:39494: 535 Incorrect authentication data (set_id=postmaster@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-25 20:06:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53017: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.248.4.85
country_id: 1269750
description:
Jan 25 20:07:20 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.248.4.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2026-01-25 20:07:22 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:63903: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-25 20:08:12 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53049: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.121.95.81
country_id: 2589581
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/product-details.php?id=385699 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-25 20:12:23 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51609: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.130.70
country_id: 1269750
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/product-detail.php?id=981970 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.91.85.69
country_id: 3437598
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/award.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.15.248.224
country_id: 3686110
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=934392 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.136.143.220
country_id: 1733045
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=89 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2026-01-25 20:19:43 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:33774: 535 Incorrect authentication data


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.213.154.248
country_id: 2661886
domain: www.evergrown.com.my
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:grub-client-1.5.3; (grub-client-1.5.3; Crawl your own stuff with http://grub.org)||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.152
country_id: 732800
description:
2026-01-25 20:23:16 H=([94.156.152.152]) [94.156.152.152]:56419 F=<altawashtrading_15@yahoo.com> rejected RCPT <sales@wcc.com.my>: Rejected relay attempt: '94.156.152.152' From: 'altawashtrading_15@yahoo.com' To: 'sales@wcc.com.my'


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.164.166
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=186475 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.185.47.115
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-32.216.185.47.115||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.240.191
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=951091 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 180.149.32.98
country_id: 6252001
description:
2026-01-25 20:37:19 712951 [Warning] Aborted connection 712951 to db: 'unconnected' user: 'unauthenticated' host: '180.149.32.98' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 180.149.32.98
country_id: 6252001
description:
2026-01-25 20:37:19 712958 [Warning] Aborted connection 712958 to db: 'unconnected' user: 'unauthenticated' host: '180.149.32.98' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.72.157
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-40.142.111.72.157||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.43.184.173
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-42.45.43.184.173||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/images/contact.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.33
country_id: 3469034
description:
Jan 25 20:45:49 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.33
country_id: 3469034
description:
Jan 25 20:46:05 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.122.162
country_id: 226074
description:
Jan 25 20:46:14 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.122.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 106.38.226.199
country_id: 1814991
domain: www.indfinitydesign.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; OnePlus 7 Build/QQ3A.200805.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_170500 JsSdk/1.0 NetType/4G Channel/local_test AppName/aweme app_version/17.5.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 TTWebView/0751130036105||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.159.80.18
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.164.255.186
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tag/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.24.5.140
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tag/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.36.240.255
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.128.108.99
country_id: 1643084
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.154.176.128
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tag/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.102.246
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tag/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.14.246.227
country_id: 3686110
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.109.209.230
country_id: 2589581
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tag/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.166.195.184
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.99.5.46
country_id: 2017370
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tag/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.170.74
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.172.205
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tag/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.81.100.38
country_id: 3686110
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tag/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.139.3
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tag/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.49.179.227
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tag/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.106.35.108
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.179.22.219
country_id: 2464461
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.37.128.128
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.156.189.93
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.13.62
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.191.221.255
country_id: 337996
domain: www.plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.plomalite.com/images/DSC00857.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.239.73.215
country_id: 3865483
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-08.104.239.73.215||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
country_id: 1814991
description:
Jan 25 21:10:27 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.85.6
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/productt.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.6
country_id: 290557
description:
Jan 25 21:10:21 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 38.44.17.50
country_id: 3508796
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/10-hinting-full.conf||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-25 21:14:50 H=(localhost.localdomain) [78.153.140.207]:48296 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-25 21:18:00 H=(localhost.localdomain) [78.153.140.207]:35692 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.234.135.54
country_id: 1562822
description:
2026-01-25 21:20:03 dovecot_login authenticator failed for H=(125.234.135.54.hcm.viettel.vn) [125.234.135.54]:43832: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.153.72
country_id: 1562822
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/services.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.243.234.23
country_id: 6252001
description:
Jan 25 21:27:29 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.243.234.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-01-25 21:27:31 dovecot_plain authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net (eutter) [73.243.234.23]:36020: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.7.141
country_id: 1269750
description:
Jan 25 21:38:45 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.7.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.38
country_id: 798544
description:
Jan 25 21:39:14 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.101.21.105
country_id: 241170
description:
[2026-01-25 21:41:26 +0800] info [webmaild] 185.101.21.105 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.209.129.147
country_id: 1522867
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/product-category.php?id=6 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.188
country_id: 953987
description:
Jan 25 21:45:57 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.188 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 35.232.247.91
country_id: 6252001
description:
2026-01-25 21:45:29 715397 [Warning] Aborted connection 715397 to db: 'unconnected' user: 'unauthenticated' host: '35.232.247.91' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 35.232.247.91
country_id: 6252001
description:
2026-01-25 21:45:32 715406 [Warning] Aborted connection 715406 to db: 'unconnected' user: 'unauthenticated' host: '35.232.247.91' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.188
country_id: 953987
description:
Jan 25 21:46:05 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.171.49.113
country_id: 587116
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/item/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 35.232.247.91
country_id: 6252001
description:
2026-01-25 21:50:34 715536 [Warning] Aborted connection 715536 to db: 'unconnected' user: 'unauthenticated' host: '35.232.247.91' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 35.232.247.91
country_id: 6252001
description:
2026-01-25 21:50:37 715543 [Warning] Aborted connection 715543 to db: 'unconnected' user: 'unauthenticated' host: '35.232.247.91' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.116.246.28
country_id: 953987
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/YtsFoldedScalars.yml HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 82.156.114.246
country_id: 1814991
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/samba.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan 25 21:59:38 sv3 pure-ftpd[4171998]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.48.210.89
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/fabricator-member.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.255.56.139
country_id: 2589581
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/ApacheRequestTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.226.207.165
country_id: 3469034
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/tel:60358887001 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.213.84.34
country_id: 2328926
description:
[2026-01-25 22:05:17 +0800] info [cpaneld] 102.213.84.34 - uumismed "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.14.16
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=508596 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.213.84.34
country_id: 2328926
description:
[2026-01-25 22:10:53 +0800] info [cpaneld] 102.213.84.34 - uumismed "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.75
country_id: 933860
description:
Jan 25 22:14:49 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.75
country_id: 933860
description:
Jan 25 22:15:04 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.180
country_id: 3175395
description:
Jan 25 22:15:11 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.3
country_id: 953987
description:
Jan 25 22:20:46 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.3
country_id: 953987
description:
Jan 25 22:21:01 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.50
country_id: 226074
description:
Jan 25 22:25:40 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.32
country_id: 3469034
description:
Jan 25 22:25:50 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.211
country_id: 3175395
description:
Jan 25 22:25:52 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.180
country_id: 953987
description:
Jan 25 22:25:17 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.65.35
country_id: 3469034
description:
Jan 25 22:25:17 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.252.65.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.77
country_id: 953987
description:
Jan 25 22:25:19 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.6.221
country_id: 690791
description:
Jan 25 22:25:39 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.6.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.106.155.68
country_id: 798544
description:
Jan 25 22:25:40 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.106.155.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.68.178.211
country_id: 3175395
description:
Jan 25 22:26:05 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.68.178.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.32
country_id: 3469034
description:
Jan 25 22:26:05 sv3 auth[3979807]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/about.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.123
country_id: 6252001
description:
2026-01-25 22:34:33 717117 [Warning] Aborted connection 717117 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.123' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.240
country_id: 3469034
description:
Jan 25 22:35:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.153.215.88
country_id: 146669
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Masking Tape 1-1-120x120.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.153.215.88
country_id: 146669
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Masking Tape 1-1-120x120.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.240
country_id: 3469034
description:
Jan 25 22:36:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-25 22:36:15 H=(localhost.localdomain) [78.153.140.207]:55940 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.52.32.226
country_id: 1733045
description:
[2026-01-25 22:37:26 +0800] info [webmaild] 60.52.32.226 - kwangpeng@ktlog.com.my "GET /cpsess6190763886/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.155.146
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/c-10.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.96.95.21
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-46.172.96.95.21||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.235.8
country_id: 1327865
description:
Jan 25 22:51:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.235.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.235.8
country_id: 1327865
description:
2026-01-25 22:51:31 dovecot_login authenticator failed for H=([103.68.235.8]) [103.68.235.8]:35716: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-25 23:07:04 H=([77.83.39.167]) [77.83.39.167]:52336 F=<stevenwelboun@op.pl> rejected RCPT <cky@ahfengineering.com>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/images/sliders/contact.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-25 23:09:17 H=(localhost.localdomain) [78.153.140.207]:39766 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.131.2
country_id: 3608932
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-12.191.102.131.2||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.209.44.9
country_id: 2661886
description:
Jan 25 23:15:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.209.44.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.209.44.9
country_id: 2661886
description:
2026-01-25 23:15:54 dovecot_login authenticator failed for H=217-209-44-9-no600.tbcn.telia.com [217.209.44.9]:46618: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/login.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.250
country_id: 51537
description:
Jan 25 23:21:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.117
country_id: 3175395
description:
Jan 25 23:21:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.64.108.31
country_id: 3175395
description:
Jan 25 23:21:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.64.108.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.108.31
country_id: 3175395
description:
2026-01-25 23:21:49 dovecot_plain authenticator failed for H=([100.64.100.6]) [64.64.108.31]:3803: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.64.108.31
country_id: 3175395
description:
Jan 25 23:22:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.64.108.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.108.31
country_id: 3175395
description:
2026-01-25 23:22:03 dovecot_plain authenticator failed for H=([100.64.100.6]) [64.64.108.31]:14658: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.157.169
country_id: 99237
description:
Jan 25 23:22:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.157.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.253
country_id: 3175395
description:
Jan 25 23:29:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.33.26
country_id: 660013
domain: www.modern.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.modern.com.my/wp-content/uploads/2018/10/modernone3-01.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.56
country_id: 3865483
description:
Jan 25 23:36:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.242
country_id: 953987
description:
Jan 25 23:36:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.242
country_id: 953987
description:
Jan 25 23:37:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: figofoods.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_44) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4044.92 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.180
country_id: 6252001
description:
Jan 25 23:42:33 sv3 pure-ftpd[41049]: (?@147.185.132.180) [INFO] New connection from 147.185.132.180


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 193.243.147.72
country_id: 3017382
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.224 Safari/537.56||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.127.115.58
country_id: 798549
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/oit/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.144.118
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/oit/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.241.48.228
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/oit/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.0.68.99
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/oit/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.42.40.173
country_id: 2963597
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/oit/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.240.17.52
country_id: 2464461
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/oit/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.59.162
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/oit/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.40.181.104
country_id: 272103
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/oit/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.227.213
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/oit/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.44.61
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/oit/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.172.110.137
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/oit/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.85.157.227
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/news/Politics/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.226.84
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/news/Politics/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 137.59.223.119
country_id: 1168579
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/news/Politics/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.103.100.37
country_id: 1168579
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/news/Politics/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.160.83
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/news/Politics/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.141.157.118
country_id: 2542007
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/news/Politics/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.131.64.28
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/news/Politics/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.241.159.120
country_id: 174982
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/news/Politics/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.95.165.64
country_id: 3686110
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/news/Politics/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.188.137
country_id: 337996
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/news/Politics/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.196.240.132
country_id: 357994
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/news/Politics/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.187.171.107
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.164.255.137
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.56.219.5
country_id: 3932488
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.161.167
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.250.127.129
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.220.63.171
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.55.11
country_id: 1168579
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.68.179
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.137.48.104
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.113.1.232
country_id: 2260494
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.66.222.240
country_id: 286963
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.111.241.175
country_id: 2464461
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/shoplist/search/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.30
country_id: 2510769
description:
Jan 26 00:00:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.25.213.204
country_id: 2963597
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-02.82.25.213.204||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.171
country_id: 1269750
description:
Jan 26 00:04:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.171
country_id: 1269750
description:
Jan 26 00:04:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.132
country_id: 6290252
description:
Jan 26 00:05:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.151
country_id: 1733045
description:
[2026-01-26 00:06:08 +0800] info [webmaild] 161.142.118.151 - s-osada@mckd.com.my "GET /cpsess1087082256/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.105.252
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Document Box/Document Box -2-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.105.252
country_id: 6252001
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Document Box/Document Box -2-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
country_id: 2017370
description:
Jan 26 00:07:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-26 00:07:20 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:47326: 535 Incorrect authentication data (set_id=autoreply@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.99.248.119
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=88 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.227.45
country_id: 337996
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/hamcrest/hamcrest-php/tests/bootstrap.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.245.100.164
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-15.171.245.100.164||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.88
country_id: 732800
description:
Jan 26 00:19:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.88 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.43
country_id: 6252001
description:
2026-01-26  0:20:14 721647 [Warning] Aborted connection 721647 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.43' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/images/sliders/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.125.243.173
country_id: 2635167
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack/Comparison-1-150x150.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.125.243.173
country_id: 2635167
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack/Comparison-1-150x150.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.18.242.182
country_id: 732800
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/sangaku/liaison/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.97.36.149
country_id: 290557
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/sangaku/liaison/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.206.62.246
country_id: 2542007
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/sangaku/liaison/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.205.56.145
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/sangaku/liaison/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.115.252.219
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/sangaku/liaison/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.181.43.44
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/sangaku/liaison/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.188.92.104
country_id: 1168579
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/sangaku/liaison/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.228.70
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/sangaku/liaison/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.12.205
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/sangaku/liaison/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.56.193.244
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/japanese/sangaku/liaison/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.248
country_id: 1269750
description:
Jan 26 00:28:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.202
country_id: 6252001
description:
Jan 26 00:30:48 sv3 pure-ftpd[69230]: (?@162.142.125.202) [INFO] New connection from 162.142.125.202


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.87
country_id: 6252001
description:
2026-01-26  0:31:43 722291 [Warning] Aborted connection 722291 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.87' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.11.25
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/web/news/details/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.51.34.129
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/web/news/details/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.223.108.246
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/web/news/details/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.252.87.212
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/web/news/details/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.85.95.74
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/web/news/details/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.177.244.49
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/web/news/details/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.216.82.43
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/web/news/details/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.189.232.168
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/web/news/details/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.82.211.200
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/web/news/details/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.10.0.195
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/web/news/details/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.241.36.40
country_id: 248816
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/web/news/details/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.121.146.203
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 199.45.155.70
country_id: 6252001
description:
2026-01-26  0:33:59 722345 [Warning] Aborted connection 722345 to db: 'unconnected' user: 'unauthenticated' host: '199.45.155.70' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 223.29.253.70
country_id: 1814991
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-35.223.29.253.70||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.254.134
country_id: 3469034
description:
Jan 26 00:35:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.254.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.80.50
country_id: 1269750
description:
Jan 26 00:35:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.80.50
country_id: 1269750
description:
Jan 26 00:36:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.80.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.42.228.250
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=621414 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.42.124.74
country_id: 1835841
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/Thumb_790x600-21.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.251
country_id: 1269750
description:
Jan 26 00:40:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.100
country_id: 3469034
description:
Jan 26 00:41:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.144.161.43
country_id: 953987
domain: u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/u-net.com.my/service-refrigerator HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.77.178.91
country_id: 3469034
domain: u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/u-net.com.my/about HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.175.219
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=8429605304 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.32.115
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-45.168.91.32.115||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.16.216.54
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=263428 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.232.222
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=69&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.89.1.177
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=264985 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.47.182.94
country_id: 6252001
description:
Jan 26 00:53:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.47.182.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.182.94
country_id: 6252001
description:
2026-01-26 00:53:10 dovecot_login authenticator failed for H=host94.sub-63-47-182.myvzw.com [63.47.182.94]:20056: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/press.php||SC:/home/indfinitydesign/public_html/img/photos/press.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.115
country_id: 3469034
description:
Jan 26 00:58:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.236.242.69
country_id: 2629691
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/data/Mix-120x120.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.236.242.69
country_id: 2629691
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/data/Mix-120x120.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.115
country_id: 3469034
description:
Jan 26 00:59:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/587.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.105.186
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-05.166.0.105.186||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.203.98.245
country_id: 3686110
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=46661515394289 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.223.31
country_id: 798544
description:
Jan 26 01:08:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.223.31 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
country_id: 1814991
description:
Jan 26 01:10:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2026-01-26 01:10:12 dovecot_login authenticator failed for H=([111.61.176.244]) [111.61.176.244]:14762: 535 Incorrect authentication data (set_id=legal@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.144
country_id: 3469034
description:
Jan 26 01:11:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.42
country_id: 3175395
description:
Jan 26 01:13:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.70
country_id: 1814991
description:
Jan 26 01:14:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.87.70
country_id: 1814991
description:
2026-01-26 01:14:42 dovecot_login authenticator failed for H=([111.61.87.70]) [111.61.87.70]:40302: 535 Incorrect authentication data (set_id=legal@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
country_id: 1835841
description:
Jan 26 01:14:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-01-26 01:14:17 dovecot_login authenticator failed for H=([203.123.219.137]) [203.123.219.137]:54040: 535 Incorrect authentication data (set_id=legal@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.142.193.146
country_id: 798549
description:
Jan 26 01:15:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.142.193.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.193.146
country_id: 798549
description:
2026-01-26 01:15:35 dovecot_plain authenticator failed for H=(gmail.com) [45.142.193.146]:42699: 535 Incorrect authentication data (set_id=info@nocser.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.25.44
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=934392 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.142.193.146
country_id: 798549
description:
Jan 26 01:18:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.142.193.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.193.146
country_id: 798549
description:
2026-01-26 01:18:34 dovecot_plain authenticator failed for H=(gmail.com) [45.142.193.146]:7959: 535 Incorrect authentication data (set_id=info@cabe.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.2.46.159
country_id: 1643084
description:
Jan 26 01:18:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.2.46.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.142.193.146
country_id: 798549
description:
Jan 26 01:27:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.142.193.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.193.146
country_id: 798549
description:
2026-01-26 01:27:30 dovecot_plain authenticator failed for H=(gmail.com) [45.142.193.146]:58112: 535 Incorrect authentication data (set_id=info@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.252
country_id: 953987
description:
Jan 26 01:30:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.252 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.136
country_id: 6252001
description:
2026-01-26  1:31:04 724134 [Warning] Aborted connection 724134 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.136' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.41
country_id: 3175395
description:
Jan 26 01:31:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.252
country_id: 953987
description:
Jan 26 01:31:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.252 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.169.229
country_id: 149590
description:
Jan 26 01:34:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.78.169.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.234.140
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=14 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.16
country_id: 2300660
description:
Jan 26 01:34:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.2.29
country_id: 1269750
description:
Jan 26 01:38:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.2.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.154.160.14
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.34.169
country_id: 337996
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.49.162
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.19.110
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.170.195.211
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.31.196.22
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.89.83.163
country_id: 2328926
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.218.106
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.255.22.229
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.94.85.232
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.20.218.46
country_id: 163843
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.75.64.115
country_id: 2260494
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/category/middle/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.152.227
country_id: 3469034
description:
Jan 26 01:43:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.152.227 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.64.15
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=31&sub=86 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.236.27.114
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=8097 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.42
country_id: 3469034
description:
Jan 26 01:47:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.42
country_id: 3469034
description:
Jan 26 01:48:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.0.189.231
country_id: 3469034
description:
Jan 26 01:50:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.0.189.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.33
country_id: 798544
description:
Jan 26 01:50:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.144.128.239
country_id: 3996063
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/3.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.190.137
country_id: 192950
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/about.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.139.144.172
country_id: 1210997
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.40.227.252
country_id: 286963
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/logo-bawah.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.107.24.44
country_id: 290557
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/7.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.134.57.227
country_id: 614540
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/csr2-1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.50.178.113
country_id: 3439705
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/corevalue.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.121.253.25
country_id: 3469034
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/ISO_14001-2015_(EMS)(2023-2026)_page-0001.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.91.210.18
country_id: 587116
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/ISO9001-2015(QMS)(2023-2026)_page-0001.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.32.212.68
country_id: 3686110
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/sustain.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.68.52.111
country_id: 3469034
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/csr4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.250.16
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.171.206.108
country_id: 99237
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/2018-20201.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.234.27.131
country_id: 1522867
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/8.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.184.159.142
country_id: 3996063
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.169.109.66
country_id: 3996063
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.67.141
country_id: 99237
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/ISO_45001-2018(OHS)(2023-2026)_page-0001.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.40.135
country_id: 3865483
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.115.239.172
country_id: 2782113
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/Background-Design-The3me-Light-Gray.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.196.10
country_id: 1562822
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/icon/logo-black.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.207.239.22
country_id: 3624060
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/corp.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.208.220
country_id: 248816
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/banner_1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.99.119.219
country_id: 290557
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/csr3-1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.162.57.33
country_id: 1210997
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/ISO_50001-2018(EnMS)(2023-2026)_page-0001.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.240.141.177
country_id: 690791
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/csr1-1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.171.117.34
country_id: 3625428
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.43.53
country_id: 6252001
description:
2026-01-26 01:56:34 dovecot_login authenticator failed for H=(bLgACJ) [84.239.43.53]:23595: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.43.53
country_id: 6252001
description:
2026-01-26 01:57:05 dovecot_login authenticator failed for H=(nDkwkIT) [84.239.43.53]:22218: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.83.254
country_id: 1562822
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/part-accessories.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.0.116.175
country_id: 163843
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/06kyouin/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.96.96.221
country_id: 2542007
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/06kyouin/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.55.131.4
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=45151515376407 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.42.23.114
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/taxi/faq/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.10.217.68
country_id: 3489940
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/taxi/faq/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.155.0.202
country_id: 163843
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/taxi/faq/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.117.54.53
country_id: 1814991
description:
2026-01-26 02:03:21 dovecot_login authenticator failed for H=([180.117.54.53]) [180.117.54.53]:51538: 535 Incorrect authentication data (set_id=help@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.122.79.246
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12741516002714 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.100
country_id: 3175395
description:
Jan 26 02:12:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.234.218.70
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1&sub=33 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.98
country_id: 690791
description:
Jan 26 02:13:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.236.165
country_id: 3865483
description:
Jan 26 02:14:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.236.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.26
country_id: 3469034
description:
Jan 26 02:14:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.60.239
country_id: 1819730
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Mix-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.60.239
country_id: 1819730
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Mix-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Jan 26 02:22:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-26 02:22:39 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:56808: 535 Incorrect authentication data (set_id=help@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.112
country_id: 3469034
description:
Jan 26 02:27:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.112 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.44.52.145
country_id: 1269750
domain: acburn.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:12408.acburn.com.my||ServerName:acburn.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9affea731d739fdd1f8f6b810a1c45ce6df2d0fa||Title:0xa3d180b5||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.67.141.217
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34351516691467 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.74.150
country_id: 1149361
description:
Jan 26 02:40:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.74.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.246.115.179
country_id: 1819730
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/8280649870.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.147.119.11
country_id: 1522867
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-43.91.147.119.11||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.75.108
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-45.92.71.75.108||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.57
country_id: 6252001
description:
2026-01-26  2:46:09 726608 [Warning] Aborted connection 726608 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.57' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.192.19.89
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/20220323-OYTEW982119/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.51.159
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/20220323-OYTEW982119/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.39.79.50
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/20220323-OYTEW982119/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.181.5.98
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/20220323-OYTEW982119/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.79.103.21
country_id: 2542007
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/20220323-OYTEW982119/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.146.133
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/20220323-OYTEW982119/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.99.87.151
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/20220323-OYTEW982119/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.123.248.63
country_id: 3437598
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/20220323-OYTEW982119/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.238.161
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/20220323-OYTEW982119/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.85
country_id: 2510769
description:
Jan 26 02:47:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.219.144.3
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.225.86
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.186.81.230
country_id: 831053
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.57.229.118
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.18.155.250
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.108.207.187
country_id: 3378535
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.10.194.61
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.66.221
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.145.89
country_id: 3658394
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.170.196.229
country_id: 690791
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.217.158.218
country_id: 587116
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.163.113.75
country_id: 690791
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/extension/fullindex/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/zh_CN/index.db||User:root||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 106.75.157.47
country_id: 1814991
description:
2026-01-26  2:53:40 726885 [Warning] Aborted connection 726885 to db: 'unconnected' user: 'unauthenticated' host: '106.75.157.47' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.5
country_id: 798544
description:
Jan 26 02:54:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.5
country_id: 798544
description:
Jan 26 02:55:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.5 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.7
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/anaconda/lvm.log||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.148.108
country_id: 3469034
description:
Jan 26 02:55:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.148.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.231
country_id: 953987
description:
Jan 26 02:55:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.153.137
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Document Box - new printing - External Carton Size-1-80x80.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.153.137
country_id: 1880251
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Document Box - new printing - External Carton Size-1-80x80.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.231
country_id: 953987
description:
Jan 26 02:56:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.5
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/UPower/UPower.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.3
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/lock_manager_local.ini||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
country_id: 1835841
description:
Jan 26 03:08:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-01-26 03:08:10 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:48128: 535 Incorrect authentication data (set_id=hr@manforce.net)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 193.243.147.72
country_id: 3017382
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/937.36 (KHTML, like Gecko) HeadlessChrome/125.0.5790.102 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.129.75.209
country_id: 2260494
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maatwebsite/excel/CODE_OF_CONDUCT.md HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.10
country_id: 3469034
description:
Jan 26 03:13:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.163.198.10
country_id: 3469034
description:
Jan 26 03:14:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.163.198.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.177
country_id: 2510769
description:
Jan 26 03:14:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.177 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 193.243.147.72
country_id: 3017382
domain: figofoods.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/122.0.6261.57 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.188.218
country_id: 3469034
description:
Jan 26 03:19:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.188.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.172.79.198
country_id: 1819730
description:
Jan 26 03:20:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.172.79.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.188.218
country_id: 3469034
description:
Jan 26 03:20:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.188.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.11
country_id: 953987
description:
Jan 26 03:20:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-01-26 03:20:57 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:65301: 535 Incorrect authentication data (set_id=hr@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.223.237
country_id: 1269750
description:
Jan 26 03:21:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.223.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.122
country_id: 3865483
description:
Jan 26 03:22:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.10
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/legacy.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.202
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/lvm2.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.242
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/nscd.conf||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 14.187.154.150
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-31.14.187.154.150||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-26 03:32:51 +0800] info [cpaneld] 202.178.120.157 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/116.0.5845.82 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 66.93.227.25
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-35.66.93.227.25||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.227.152
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=571193 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.241
country_id: 3175395
description:
Jan 26 03:39:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.161.78
country_id: 3469034
description:
Jan 26 03:39:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.161.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/125.0.6422.60 Safari/337.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.88
country_id: 3469034
description:
Jan 26 03:41:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.0.74.149
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-42.117.0.74.149||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.209.196.174
country_id: 2921044
description:
Jan 26 03:43:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.209.196.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.196.174
country_id: 2921044
description:
2026-01-26 03:43:22 dovecot_plain authenticator failed for H=(LAPTOP-R73IBIE3) [185.209.196.174]:60095: 535 Incorrect authentication data (set_id=support@task.visoft.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.209.196.174
country_id: 2921044
description:
Jan 26 03:46:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.209.196.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.196.174
country_id: 2921044
description:
2026-01-26 03:46:29 dovecot_plain authenticator failed for H=(LAPTOP-R73IBIE3) [185.209.196.174]:58863: 535 Incorrect authentication data (set_id=develop@collections.visoft.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.200.81
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/contact.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.60.254
country_id: 798544
description:
Jan 26 03:49:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.60.254 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.44.199.253
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maennchen/zipstream-php/src/Bigint.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.51
country_id: 298795
description:
Jan 26 03:49:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-26 03:56:09 +0800] info [cpaneld] 202.178.120.157 - KIk! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.126
country_id: 3175395
description:
Jan 26 03:56:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.155.158
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/info/2022/01/10/4489/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.222.36
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/info/2022/01/10/4489/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.77.214
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/info/2022/01/10/4489/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.137.69
country_id: 3658394
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/info/2022/01/10/4489/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.192.66.119
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/info/2022/01/10/4489/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.182.217
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/info/2022/01/10/4489/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.151.136.91
country_id: 614540
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/info/2022/01/10/4489/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.106.203.17
country_id: 783754
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/info/2022/01/10/4489/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.186.219
country_id: 3595528
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/info/2022/01/10/4489/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.235.42.133
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/info/2022/01/10/4489/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.62.111.85
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/info/2022/01/10/4489/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.138.64
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fs/kaigo/c/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.25.54
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fs/kaigo/c/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.166.200.195
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fs/kaigo/c/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.147.101.134
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fs/kaigo/c/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.80.12.168
country_id: 3378535
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fs/kaigo/c/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.147.4
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fs/kaigo/c/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.142.253.78
country_id: 2400553
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fs/kaigo/c/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.188.10.31
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fs/kaigo/c/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.214.101.250
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fs/kaigo/c/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.240.131
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fs/kaigo/c/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.231.59.54
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fs/kaigo/c/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.125
country_id: 617790
domain: empirelog.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/118.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.145.14
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=899701 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.193.54
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=77051514881482 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.174.211.117
country_id: 6252001
description:
Jan 26 04:15:09 sv3 pure-ftpd[196438]: (?@172.174.211.117) [INFO] New connection from 172.174.211.117


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.246.99.177
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/sponsor-cabinet.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 161.35.144.49
country_id: 2750405
description:
2026-01-26  4:18:29 730033 [Warning] Aborted connection 730033 to db: 'unconnected' user: 'unauthenticated' host: '161.35.144.49' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
country_id: 1814991
description:
Jan 26 04:19:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2026-01-26 04:19:04 dovecot_login authenticator failed for H=([111.50.70.34]) [111.50.70.34]:38810: 535 Incorrect authentication data (set_id=autoreply@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.75.149.36
country_id: 3077311
description:
Jan 26 04:21:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.75.149.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.217.104
country_id: 3469034
description:
Jan 26 04:21:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.217.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 26 04:22:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-26 04:22:19 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:4844: 535 Incorrect authentication data (set_id=autoreply@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.95.7
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=515102 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.250.144.213
country_id: 2542007
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74861514942266 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux aarch54) AppleWebKit/537.34 (KHTML, like Gecko) HeadlessChrome/120.0.6399.224 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.35.70
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-29.168.91.35.70||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.94.212
country_id: 3469034
description:
Jan 26 04:31:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.94.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.94.212
country_id: 3469034
description:
Jan 26 04:32:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.94.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.202
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/etc.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.85
country_id: 2510769
description:
Jan 26 04:32:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.85 has been locked due to Imunify RBL


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 162.43.239.153
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; SM-A205U Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/124.0.6367.159 Mobile Safari/537.36 musical_ly_2023405050 JsSdk/1.0 NetType/4G Channel/googleplay AppName/musical_ly app_version/34.5.5 ByteLocale/en ByteFullLocale/en Region/CA AppId/1233 Spark/1.5.4.10-bugfix AppVersion/34.5.5 BytedanceWebview/d8a21c6||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.255.181.30
country_id: 6251999
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/product/document-box-heavy-duty HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.255.181.99
country_id: 6251999
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/product/moving-box-extra-large-heavy-duty HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.151.216
country_id: 1269750
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/activity-details.php?id=222230 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.157.52.9
country_id: 99237
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press-details.php?id=949056 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-26 04:40:19 H=([31.145.189.54]) [31.145.189.54]:54494 F=<dse_NA2@docusign.net> rejected RCPT <info@astlog.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.198.133.187
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=34 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-26 04:43:33 H=([31.145.189.54]) [31.145.189.54]:57600 F=<dse_NA2@docusign.net> rejected RCPT <info@ktlog.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.50.218.26
country_id: 6251999
description:
2026-01-26 04:45:40 dovecot_plain authenticator failed for H=([10.25.18.90]) [149.50.218.26]:16907: 535 Incorrect authentication data (set_id=kumara.rao@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/portfolio-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.50.218.26
country_id: 6251999
description:
2026-01-26 04:47:19 dovecot_plain authenticator failed for H=([10.25.18.90]) [149.50.218.26]:24988: 535 Incorrect authentication data (set_id=kumara.rao@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.156.36.14
country_id: 3686110
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1098 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 14.187.189.253
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-51.14.187.189.253||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-26 04:52:06 +0800] info [cpaneld] 202.178.120.157 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.41
country_id: 3175395
description:
Jan 26 04:52:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.41
country_id: 3175395
description:
Jan 26 04:53:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.16
country_id: 953987
description:
Jan 26 04:53:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.37
country_id: 690791
description:
Jan 26 04:53:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-26 04:54:01 H=([31.145.189.54]) [31.145.189.54]:59730 F=<dse_NA2@docusign.net> rejected RCPT <info@pspoly.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.216.60
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=21051514942871 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.233
country_id: 2300660
description:
Jan 26 05:02:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.233
country_id: 2300660
description:
Jan 26 05:03:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.146.212
country_id: 3469034
description:
Jan 26 05:03:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.146.212 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.83.84.214
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-04.77.83.84.214||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.4
country_id: 798544
description:
Jan 26 05:06:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.199.13
country_id: 2510769
description:
Jan 26 05:07:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.199.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.84.115.34
country_id: 3469034
description:
Jan 26 05:07:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.84.115.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.84.115.34
country_id: 3469034
description:
Jan 26 05:08:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.84.115.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.59
country_id: 3175395
description:
Jan 26 05:08:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 26 05:08:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-26 05:08:30 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:54732: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 138.199.59.148
country_id: 798544
description:
2026-01-26  5:09:37 732107 [Warning] Aborted connection 732107 to db: 'unconnected' user: 'unauthenticated' host: '138.199.59.148' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 31.171.130.145
country_id: 2635167
description:
2026-01-26  5:11:33 732155 [Warning] Aborted connection 732155 to db: 'unconnected' user: 'unauthenticated' host: '31.171.130.145' (This connection closed normally without authentication)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.202
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/factory/etc/nsswitch.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.121.147.104
country_id: 630336
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/kurabetenet/rakutenmobile-store/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.227.74.183
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/kurabetenet/rakutenmobile-store/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 132.255.109.62
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/kurabetenet/rakutenmobile-store/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.98.116.26
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/kurabetenet/rakutenmobile-store/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.241.251.129
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/kurabetenet/rakutenmobile-store/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.177.183.82
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/kurabetenet/rakutenmobile-store/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.160.180.53
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/kurabetenet/rakutenmobile-store/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.43.98.204
country_id: 614540
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/kurabetenet/rakutenmobile-store/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.108
country_id: 2510769
description:
Jan 26 05:14:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.108 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.82.91
country_id: 3686110
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/kurabetenet/rakutenmobile-store/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.35.106
country_id: 3658394
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/kurabetenet/rakutenmobile-store/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.178.201.189
country_id: 357994
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/kurabetenet/rakutenmobile-store/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/85.3.4182.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.174.63
country_id: 99237
description:
Jan 26 05:16:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.174.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
country_id: 1814991
description:
Jan 26 05:16:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.109
country_id: 3469034
description:
Jan 26 05:16:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.212.200.144
country_id: 1880251
description:
Jan 26 05:16:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.212.200.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
country_id: 1814991
description:
Jan 26 05:17:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
country_id: 1814991
description:
Jan 26 05:17:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/img/photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
country_id: 1814991
description:
Jan 26 05:18:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-01-26 05:18:15 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:59295: 535 Incorrect authentication data (set_id=autoreply@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.244
country_id: 1814991
description:
Jan 26 05:18:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
country_id: 1814991
description:
Jan 26 05:19:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.8
country_id: 3469034
description:
Jan 26 05:27:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/component/tag/images/portfolio-detail.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.111
country_id: 3469034
description:
Jan 26 05:28:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.161
country_id: 3469034
description:
Jan 26 05:28:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.199
country_id: 1269750
description:
Jan 26 05:30:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.244
country_id: 3865483
description:
Jan 26 05:30:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.244 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.141.193.48
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=23811514527372 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.120.142.233
country_id: 2510769
description:
Jan 26 05:33:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.120.142.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2026-01-26 05:33:23 dovecot_plain authenticator failed for H=(epment) [185.120.142.233]:33284: 535 Incorrect authentication data (set_id=callen@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.239
country_id: 3469034
description:
Jan 26 05:35:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.98.30.249
country_id: 3865483
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/firstswizerland.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.36
country_id: 798544
description:
Jan 26 05:35:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.167.200
country_id: 1562822
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product.php?id=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.197.138
country_id: 6252001
description:
2026-01-26 05:36:00 dovecot_plain authenticator failed for H=([10.9.18.127]) [37.19.197.138]:32175: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.6.169
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/swepusa.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.54.102
country_id: 6252001
description:
2026-01-26 05:36:29 dovecot_plain authenticator failed for H=([10.13.18.135]) [212.56.54.102]:42485: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.188.80.149
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/kossanvisitor.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.86.60
country_id: 3469034
description:
Jan 26 05:39:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.86.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.144.57
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/commoditypictures.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.139
country_id: 953987
description:
Jan 26 05:40:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.49
country_id: 3469034
description:
Jan 26 05:40:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.49 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.157
country_id: 2750405
description:
2026-01-26  5:41:58 733080 [Warning] Aborted connection 733080 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.157' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 195.24.236.157
country_id: 2750405
description:
2026-01-26  5:44:38 733166 [Warning] Aborted connection 733166 to db: 'unconnected' user: 'unauthenticated' host: '195.24.236.157' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.15.170
country_id: 1819730
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7420219254.jpg&size=262*388 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.239.45.10
country_id: 1269750
description:
Jan 26 05:49:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.239.45.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.23.116
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tips/trouble/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.180.147
country_id: 337996
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tips/trouble/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.29.145.144
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tips/trouble/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.150.185
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tips/trouble/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.131.248.95
country_id: 357994
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tips/trouble/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.209.54
country_id: 294640
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tips/trouble/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.255.220
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tips/trouble/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.233.30.247
country_id: 357994
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/tips/trouble/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


