# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.141
country_id: 3469034
description:
Jul 25 19:02:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.75.189
country_id: 1814991
description:
2026-07-25 19:02:53 dovecot_login authenticator failed for H=([49.124.151.25]) [183.236.75.189]:34736: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.47.137.190
country_id: 1814991
description:
2026-07-25 19:03:00 dovecot_login authenticator failed for H=([103.112.224.81]) [58.47.137.190]:55534: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 19:03:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2026-07-25 19:03:39 dovecot_login authenticator failed for H=([112.24.99.134]) [195.222.57.190]:42374: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.0.140
country_id: 2017370
description:
Jul 25 19:03:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.0.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.50.190
country_id: 1880251
description:
Jul 25 19:03:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.50.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.36.139.231
country_id: 690791
description:
Jul 25 19:03:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.36.139.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.36.139.231
country_id: 690791
description:
2026-07-25 19:03:28 dovecot_login authenticator failed for H=host-176-36-139-231.b024.la.net.ua ([218.8.87.28]) [176.36.139.231]:51432: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.140
country_id: 2017370
description:
2026-07-25 19:03:41 dovecot_login authenticator failed for H=(165-173-21-44.myrepublic.com.sg) [31.173.0.140]:40554: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Jul 25 19:03:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 19:05:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 19:06:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 19:06:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 19:06:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 19:06:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.123.204.152
country_id: 1814991
description:
2026-07-25 19:08:03 dovecot_login authenticator failed for H=([111.70.49.182]) [123.123.204.152]:35075: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2026-07-25 19:07:14 dovecot_login authenticator failed for H=(139-216-6-17.sta.dodo.net.au) [196.189.126.185]:36094: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-25 19:07:27 dovecot_login authenticator failed for H=([59.17.27.137]) [121.131.220.168]:43829: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.209.208
country_id: 1835841
description:
Jul 25 19:08:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.209.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-25 19:08:15 dovecot_login authenticator failed for H=([185.112.148.66]) [14.35.209.208]:40394: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.41.113
country_id: 1269750
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10178.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f515e52dc2efa3f8b20d05d5fc89e99eb4c6ace9||Title:0x1867a1b8||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 19:09:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
country_id: 2017370
description:
2026-07-25 19:10:27 dovecot_login authenticator failed for H=(biophormula.static.gvt.net.br) [178.178.222.58]:46890: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 19:10:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 19:10:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.88.174.143
country_id: 1814991
description:
Jul 25 19:11:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.88.174.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.88.174.143
country_id: 1814991
description:
2026-07-25 19:11:07 dovecot_login authenticator failed for H=(n233-h209.a-tc.net) [124.88.174.143]:40642: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
country_id: 2017370
description:
Jul 25 19:10:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.46.239.198
country_id: 1814991
description:
Jul 25 19:11:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.46.239.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.46.239.198
country_id: 1814991
description:
2026-07-25 19:11:23 dovecot_login authenticator failed for H=([192.111.134.12]) [121.46.239.198]:63756: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 19:11:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 19:11:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 19:11:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.190.152
country_id: 3469034
description:
Jul 25 19:12:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.190.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 19:12:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.23.3.146
country_id: 1835841
description:
Jul 25 19:12:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.23.3.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 19:12:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-25 19:12:39 dovecot_login authenticator failed for H=([1.240.101.2]) [59.23.3.146]:42564: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 19:12:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.190.152
country_id: 3469034
description:
2026-07-25 19:12:16 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [131.0.190.152]:41682: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.39.103
country_id: 2017370
description:
2026-07-25 19:13:19 dovecot_plain authenticator failed for H=broadband-109-173-39-103.ip.moscow.rt.ru (debutoce) [109.173.39.103]:46654: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 19:13:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 19:14:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 19:14:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 19:15:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 19:15:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 19:15:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 19:16:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jul 25 19:16:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 19:16:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.227.77
country_id: 3469034
description:
Jul 25 19:17:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.227.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 19:17:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.245
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-17.149.34.251.245||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.207.66.154
country_id: 6251999
description:
Jul 25 19:17:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.207.66.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-25 19:17:25 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca ([142.54.231.33]) [24.207.66.154]:32908: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
country_id: 3469034
description:
2026-07-25 19:17:42 dovecot_login authenticator failed for H=([60.171.135.254]) [179.185.227.77]:39795: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 19:18:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 19:18:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 19:19:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jul 25 19:19:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 19:19:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 19:19:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 19:19:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 19:19:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 19:20:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 19:20:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 19:22:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 19:22:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 19:23:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 19:23:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 19:24:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 19:23:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 19:24:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.183.82.70
country_id: 2017370
description:
Jul 25 19:25:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.183.82.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.183.82.70
country_id: 2017370
description:
2026-07-25 19:25:42 dovecot_login authenticator failed for H=([49.124.131.245]) [62.183.82.70]:51888: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.15.149.254
country_id: 3469034
description:
Jul 25 19:26:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.15.149.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 19:25:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 19:25:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.24.185.98
country_id: 2017370
description:
Jul 25 19:26:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.24.185.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
country_id: 2017370
description:
2026-07-25 19:26:25 dovecot_login authenticator failed for H=([94.16.17.141]) [217.24.185.98]:39852: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 19:26:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
country_id: 1814991
description:
Jul 25 19:26:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
country_id: 1814991
description:
2026-07-25 19:26:59 dovecot_login authenticator failed for H=([111.70.49.183]) [116.228.195.251]:11678: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 25 19:27:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-07-25 19:26:10 dovecot_login authenticator failed for H=(atlanta-1.cdn77.com) [201.15.149.254]:60425: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-07-25 19:27:22 dovecot_login authenticator failed for H=([113.53.251.101]) [218.17.217.141]:31358: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 19:27:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 25 19:27:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 19:27:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jul 25 19:27:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.17.217.141
country_id: 1814991
description:
Jul 25 19:27:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.17.217.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 19:28:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 68.221.130.241
country_id: 2510769
domain: yukticlick.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/yukticlick/public_html/wp-includes||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 19:28:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 19:28:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 19:28:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.169.239.198
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-28.193.169.239.198||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 19:29:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 19:29:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 19:30:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 19:30:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 19:31:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 19:31:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77350689
name: IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder
abuser: 193.228.134.216
country_id: 690791
domain: ibmcglobal.com
description:
IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder||MV:/media/com_acym/images/thumbnails/thumbnail_834.png?.php||SC:/home/ibmcglobal/public_html/media/com_acym||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.46
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-32.62.112.222.46||RSV:8.35||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.209.97.194
country_id: 1880251
description:
[2026-07-25 19:32:40 +0530] info [whostmgrd] 134.209.97.194 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


