# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.141
country_id: 3469034
description:
Jul 25 19:02:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.75.189
country_id: 1814991
description:
2026-07-25 19:02:53 dovecot_login authenticator failed for H=([49.124.151.25]) [183.236.75.189]:34736: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.47.137.190
country_id: 1814991
description:
2026-07-25 19:03:00 dovecot_login authenticator failed for H=([103.112.224.81]) [58.47.137.190]:55534: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 19:03:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2026-07-25 19:03:39 dovecot_login authenticator failed for H=([112.24.99.134]) [195.222.57.190]:42374: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.0.140
country_id: 2017370
description:
Jul 25 19:03:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.0.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.50.190
country_id: 1880251
description:
Jul 25 19:03:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.50.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.36.139.231
country_id: 690791
description:
Jul 25 19:03:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.36.139.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.36.139.231
country_id: 690791
description:
2026-07-25 19:03:28 dovecot_login authenticator failed for H=host-176-36-139-231.b024.la.net.ua ([218.8.87.28]) [176.36.139.231]:51432: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.140
country_id: 2017370
description:
2026-07-25 19:03:41 dovecot_login authenticator failed for H=(165-173-21-44.myrepublic.com.sg) [31.173.0.140]:40554: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Jul 25 19:03:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 19:05:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 19:06:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 19:06:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 19:06:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 19:06:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.123.204.152
country_id: 1814991
description:
2026-07-25 19:08:03 dovecot_login authenticator failed for H=([111.70.49.182]) [123.123.204.152]:35075: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2026-07-25 19:07:14 dovecot_login authenticator failed for H=(139-216-6-17.sta.dodo.net.au) [196.189.126.185]:36094: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-25 19:07:27 dovecot_login authenticator failed for H=([59.17.27.137]) [121.131.220.168]:43829: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.209.208
country_id: 1835841
description:
Jul 25 19:08:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.209.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-25 19:08:15 dovecot_login authenticator failed for H=([185.112.148.66]) [14.35.209.208]:40394: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.41.113
country_id: 1269750
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10178.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f515e52dc2efa3f8b20d05d5fc89e99eb4c6ace9||Title:0x1867a1b8||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 19:09:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
country_id: 2017370
description:
2026-07-25 19:10:27 dovecot_login authenticator failed for H=(biophormula.static.gvt.net.br) [178.178.222.58]:46890: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 19:10:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 19:10:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.88.174.143
country_id: 1814991
description:
Jul 25 19:11:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.88.174.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.88.174.143
country_id: 1814991
description:
2026-07-25 19:11:07 dovecot_login authenticator failed for H=(n233-h209.a-tc.net) [124.88.174.143]:40642: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
country_id: 2017370
description:
Jul 25 19:10:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.46.239.198
country_id: 1814991
description:
Jul 25 19:11:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.46.239.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.46.239.198
country_id: 1814991
description:
2026-07-25 19:11:23 dovecot_login authenticator failed for H=([192.111.134.12]) [121.46.239.198]:63756: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 19:11:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 19:11:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 19:11:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.190.152
country_id: 3469034
description:
Jul 25 19:12:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.190.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 19:12:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.23.3.146
country_id: 1835841
description:
Jul 25 19:12:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.23.3.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 19:12:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-25 19:12:39 dovecot_login authenticator failed for H=([1.240.101.2]) [59.23.3.146]:42564: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 19:12:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.190.152
country_id: 3469034
description:
2026-07-25 19:12:16 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [131.0.190.152]:41682: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.39.103
country_id: 2017370
description:
2026-07-25 19:13:19 dovecot_plain authenticator failed for H=broadband-109-173-39-103.ip.moscow.rt.ru (debutoce) [109.173.39.103]:46654: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 19:13:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 19:14:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 19:14:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 19:15:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 19:15:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 19:15:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 19:16:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jul 25 19:16:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 19:16:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.227.77
country_id: 3469034
description:
Jul 25 19:17:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.227.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 19:17:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.245
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-17.149.34.251.245||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.207.66.154
country_id: 6251999
description:
Jul 25 19:17:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.207.66.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-25 19:17:25 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca ([142.54.231.33]) [24.207.66.154]:32908: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
country_id: 3469034
description:
2026-07-25 19:17:42 dovecot_login authenticator failed for H=([60.171.135.254]) [179.185.227.77]:39795: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 19:18:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 19:18:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 19:19:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jul 25 19:19:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 19:19:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 19:19:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 19:19:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 19:19:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 19:20:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 19:20:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 19:22:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 19:22:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 19:23:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 19:23:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 19:24:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 19:23:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 19:24:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.183.82.70
country_id: 2017370
description:
Jul 25 19:25:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.183.82.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.183.82.70
country_id: 2017370
description:
2026-07-25 19:25:42 dovecot_login authenticator failed for H=([49.124.131.245]) [62.183.82.70]:51888: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.15.149.254
country_id: 3469034
description:
Jul 25 19:26:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.15.149.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 19:25:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 19:25:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.24.185.98
country_id: 2017370
description:
Jul 25 19:26:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.24.185.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
country_id: 2017370
description:
2026-07-25 19:26:25 dovecot_login authenticator failed for H=([94.16.17.141]) [217.24.185.98]:39852: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 19:26:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
country_id: 1814991
description:
Jul 25 19:26:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
country_id: 1814991
description:
2026-07-25 19:26:59 dovecot_login authenticator failed for H=([111.70.49.183]) [116.228.195.251]:11678: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 25 19:27:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-07-25 19:26:10 dovecot_login authenticator failed for H=(atlanta-1.cdn77.com) [201.15.149.254]:60425: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-07-25 19:27:22 dovecot_login authenticator failed for H=([113.53.251.101]) [218.17.217.141]:31358: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 19:27:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 25 19:27:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 19:27:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jul 25 19:27:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.17.217.141
country_id: 1814991
description:
Jul 25 19:27:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.17.217.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 19:28:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 68.221.130.241
country_id: 2510769
domain: yukticlick.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/yukticlick/public_html/wp-includes||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 19:28:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 19:28:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 19:28:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.169.239.198
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-28.193.169.239.198||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 19:29:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 19:29:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 19:30:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 19:30:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 19:31:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 19:31:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77350689
name: IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder
abuser: 193.228.134.216
country_id: 690791
domain: ibmcglobal.com
description:
IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder||MV:/media/com_acym/images/thumbnails/thumbnail_834.png?.php||SC:/home/ibmcglobal/public_html/media/com_acym||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.46
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-32.62.112.222.46||RSV:8.35||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.209.97.194
country_id: 1880251
description:
[2026-07-25 19:32:40 +0530] info [whostmgrd] 134.209.97.194 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.204.17.66
country_id: 2186224
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/class-config.php||SC:/home/globalgroupoman/public_html/images/class-config.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 19:34:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.13
country_id: 6252001
description:
Jul 25 19:36:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 19:36:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 19:36:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 19:37:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 19:37:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 19:37:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784988598202.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 19:39:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 19:39:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784988553477.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 19:39:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 19:40:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 19:41:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 19:42:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 19:42:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://emergencyacrepair1.info\">https://emergencyacrepair1.info</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.203
country_id: 2017370
description:
Jul 25 19:43:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.203
country_id: 2017370
description:
2026-07-25 19:43:05 dovecot_login authenticator failed for H=(146.47.246.220.static.netvigator.com) [178.178.194.203]:52072: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 19:42:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.85
country_id: 1814991
description:
2026-07-25 19:43:19 dovecot_login authenticator failed for H=([49.124.152.243]) [111.26.63.85]:35084: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 19:43:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 19:43:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 19:43:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.63.85
country_id: 1814991
description:
Jul 25 19:43:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.63.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 19:44:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.110.176.222
country_id: 1694008
description:
Jul 25 19:44:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.110.176.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 19:44:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.9.48
country_id: 1668284
description:
Jul 25 19:45:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.9.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 19:44:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 185.41.248.38
country_id: 690791
domain: www.ahsmarine.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.35||T:APACHE||REQUEST_URI:/wp-content/plugins/dynamic-pricing-discounts/changelog.txt||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-25 19:44:58 dovecot_login authenticator failed for H=(net-62-183-82-70.kbrnet.ru) [27.110.176.222]:47628: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.9.48
country_id: 1668284
description:
2026-07-25 19:45:10 dovecot_login authenticator failed for H=([112.186.203.10]) [101.13.9.48]:42873: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 19:45:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 19:45:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.195.35.240
country_id: 1814991
description:
Jul 25 19:46:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.195.35.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 19:46:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.195.35.240
country_id: 1814991
description:
2026-07-25 19:46:54 dovecot_login authenticator failed for H=(syn-024-142-170-231.biz.spectrum.com) [120.195.35.240]:39622: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 19:46:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 19:46:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 19:47:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.71.146.6
country_id: 2017370
description:
2026-07-25 19:47:16 dovecot_login authenticator failed for H=([103.171.39.147]) [178.71.146.6]:38942: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.71.146.6
country_id: 2017370
description:
Jul 25 19:47:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.71.146.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 19:47:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 19:48:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.41.78
country_id: 2510769
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.144.72.180
country_id: 1814991
description:
2026-07-25 19:49:43 dovecot_login authenticator failed for H=(nsg-static-178.227.75.182-airtel.com) [36.144.72.180]:54220: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.50.190
country_id: 1880251
description:
Jul 25 19:49:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.50.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 19:49:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2026-07-25 19:50:10 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com ([220.94.124.233]) [34.146.248.7]:45726: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 19:49:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 19:49:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.144.72.180
country_id: 1814991
description:
Jul 25 19:49:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.144.72.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.223.27.202
country_id: 2077456
description:
Jul 25 19:50:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.223.27.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.223.27.202
country_id: 2077456
description:
2026-07-25 19:50:48 dovecot_login authenticator failed for H=194-223-27-202.tpgi.com.au ([218.21.37.250]) [194.223.27.202]:50562: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 19:50:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.157.137.112
country_id: 1835841
description:
Jul 25 19:51:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.157.137.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.157.137.112
country_id: 1835841
description:
2026-07-25 19:51:44 dovecot_login authenticator failed for H=([183.104.220.195]) [218.157.137.112]:34416: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 19:52:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 19:52:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://toronto.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 19:52:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 19:53:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: www.yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784989402471.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 19:53:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 19:53:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 25 19:53:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 19:54:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jul 25 19:55:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 19:54:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 19:54:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 19:54:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 19:55:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 19:56:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jul 25 19:57:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 19:57:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 19:57:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 19:57:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-25 19:57:16 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 19:59:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 19:58:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 19:58:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 19:59:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 19:59:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.138.254.1
country_id: 2017370
description:
Jul 25 20:00:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.138.254.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.138.254.1
country_id: 2017370
description:
2026-07-25 20:00:05 dovecot_login authenticator failed for H=([98.170.57.236]) [46.138.254.1]:34922: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 20:00:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 20:00:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 20:00:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.38.3.107
country_id: 2215636
description:
Jul 25 20:00:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.38.3.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.107
country_id: 2215636
description:
2026-07-25 20:00:23 dovecot_login authenticator failed for H=([183.6.115.88]) [102.38.3.107]:54615: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 20:01:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 20:01:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 20:01:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2026-07-25 20:02:14 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com ([72.206.74.97]) [34.146.248.7]:52362: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 20:02:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 20:02:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.188.184.13
country_id: 1814991
description:
Jul 25 20:02:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.188.184.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.184.13
country_id: 1814991
description:
2026-07-25 20:02:48 dovecot_login authenticator failed for H=([182.78.112.174]) [27.188.184.13]:56710: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 20:02:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 20:03:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 20:03:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.240
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:26595.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b46f85d881c43ef2779431f1695c6613e4fe011||Title:0x7af81a3c||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 20:05:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 20:04:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 20:04:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.27.209
country_id: 1861060
description:
Jul 25 20:04:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.95.27.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.244.208.42
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-07.185.244.208.42||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 20:06:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 20:07:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 20:08:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 20:08:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 20:08:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 20:09:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 20:09:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 20:10:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 20:10:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 20:11:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 20:11:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 20:11:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 20:11:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.109.73.135
country_id: 1835841
description:
Jul 25 20:13:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.109.73.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.109.73.135
country_id: 1835841
description:
2026-07-25 20:13:03 dovecot_login authenticator failed for H=([37.204.111.153]) [222.109.73.135]:54579: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 20:12:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 20:12:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.230.190
country_id: 2661886
description:
2026-07-25 20:13:13 dovecot_login authenticator failed for H=c188-150-230-190.bredband.tele2.se ([117.71.53.210]) [188.150.230.190]:51202: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 20:13:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 20:13:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.230.190
country_id: 2661886
description:
Jul 25 20:13:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.230.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
country_id: 290557
description:
Jul 25 20:14:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-07-25 20:14:44 dovecot_plain authenticator failed for H=(unecting) [5.32.99.14]:53735: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.66.70.156
country_id: 3996063
description:
2026-07-25 20:14:50 dovecot_plain authenticator failed for H=(fecinchyte) [200.66.70.156]:53958: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.42.119.207
country_id: 290291
description:
Jul 25 20:14:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.42.119.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.42.119.207
country_id: 290291
description:
2026-07-25 20:14:53 dovecot_plain authenticator failed for H=(tration) [46.42.119.207]:52716: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.52.179.56
country_id: 2921044
domain: arcrealtors.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/arcrealtorscom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.66.70.156
country_id: 3996063
description:
Jul 25 20:14:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.66.70.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 20:15:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.228.164.236
country_id: 2017370
description:
2026-07-25 20:15:32 dovecot_login authenticator failed for H=(mx-ll-171.5.135-77.dynamic.3bb.co.th) [193.228.164.236]:45184: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.160.72.42
country_id: 1835841
description:
Jul 25 20:15:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.160.72.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.160.72.42
country_id: 1835841
description:
2026-07-25 20:15:47 dovecot_login authenticator failed for H=([149.71.34.141]) [115.160.72.42]:32809: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 20:15:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.228.164.236
country_id: 2017370
description:
Jul 25 20:15:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.228.164.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.13
country_id: 6252001
description:
Jul 25 20:15:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.204.17.66
country_id: 2186224
domain: jaashsupplies.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/class-config.php||SC:/home/jaashsupplies/public_html/images/class-config.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 20:15:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 20:16:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 20:16:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 20:17:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 20:18:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 20:18:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 20:18:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 20:18:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 20:19:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 20:19:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 20:19:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 25 20:19:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 20:20:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 20:20:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 20:20:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 20:20:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 20:21:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 20:21:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 20:22:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 20:22:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 20:23:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 20:23:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.195.132.165
country_id: 1835841
description:
Jul 25 20:24:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.195.132.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.195.132.165
country_id: 1835841
description:
2026-07-25 20:24:05 dovecot_login authenticator failed for H=([200.164.181.17]) [175.195.132.165]:50002: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.229.237
country_id: 1835841
description:
Jul 25 20:24:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.229.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-25 20:24:22 dovecot_login authenticator failed for H=([107.181.168.150]) [211.105.229.237]:48304: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 20:25:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.223.244.3
country_id: 1269750
description:
Jul 25 20:27:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.223.244.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.244.3
country_id: 1269750
description:
2026-07-25 20:27:02 dovecot_login authenticator failed for H=([174.75.211.203]) [163.223.244.3]:60894: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 20:27:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.61.165
country_id: 895949
description:
Jul 25 20:27:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.61.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.211
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-27.45.135.228.211||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 20:27:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.61.165
country_id: 895949
description:
2026-07-25 20:27:18 dovecot_login authenticator failed for H=([192.252.210.237]) [41.63.61.165]:2098: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 20:27:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 20:28:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 182.10.161.108
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcexr7kmra7.xml.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784991512243.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 20:28:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: www.alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784991512492.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 20:28:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: www.yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784991512902.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 20:29:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 20:29:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.233.132
country_id: 1269750
description:
Jul 25 20:30:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.233.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 20:30:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 20:31:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 20:31:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 20:31:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 20:31:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.151
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-31.62.112.222.151||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jul 25 20:31:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.51.82
country_id: 1149361
description:
Jul 25 20:31:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.51.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2026-07-25 20:31:57 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [149.54.51.82]:43769: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.39.214
country_id: 1668284
description:
Jul 25 20:32:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.39.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.215.33.197
country_id: 6252001
description:
Jul 25 20:32:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.215.33.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 20:32:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.33.197
country_id: 6252001
description:
2026-07-25 20:32:40 dovecot_login authenticator failed for H=wsip-72-215-33-197.pn.at.cox.net ([77.41.156.64]) [72.215.33.197]:44968: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.214
country_id: 1668284
description:
2026-07-25 20:32:27 dovecot_login authenticator failed for H=111-70-39-214.emome-ip.hinet.net ([59.127.220.67]) [111.70.39.214]:41591: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 20:33:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 20:33:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 20:33:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 20:33:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 20:34:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 20:35:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 20:35:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.141
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-35.51.15.225.141||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 20:35:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 20:37:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 20:37:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 20:36:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 20:36:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.50.190
country_id: 1880251
description:
Jul 25 20:36:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.50.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 20:37:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 20:37:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 20:37:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.160.165.239
country_id: 2017370
description:
Jul 25 20:38:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.160.165.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.160.165.239
country_id: 2017370
description:
2026-07-25 20:38:07 dovecot_login authenticator failed for H=([211.105.229.237]) [46.160.165.239]:52376: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.84.209.188
country_id: 1814991
description:
Jul 25 20:38:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.84.209.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-07-25 20:38:27 dovecot_login authenticator failed for H=([49.125.201.68]) [223.84.209.188]:58526: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 20:39:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-25 20:41:41 dovecot_login authenticator failed for H=([221.159.118.10]) [94.16.17.139]:38882: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 20:41:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.32.197.160
country_id: 130758
description:
Jul 25 20:42:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.32.197.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.32.197.160
country_id: 130758
description:
2026-07-25 20:42:03 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [89.32.197.160]:58101: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 20:42:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 20:42:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 20:42:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 20:42:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 188.163.106.129
country_id: 690791
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:18181.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dec3ec21a8d640aea37aa3cc1412134149e2d447||Title:0x9a97a5cb||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.27.209
country_id: 1861060
description:
Jul 25 20:43:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.95.27.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 20:43:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 20:44:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 20:44:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 20:44:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.19.198.160
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-45.37.19.198.160||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 20:46:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 20:45:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 20:46:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 20:46:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 20:47:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 20:47:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 20:47:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.235.27.139
country_id: 6252001
description:
Jul 25 20:48:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.235.27.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-25 20:48:07 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net ([60.173.105.206]) [71.235.27.139]:60196: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 20:48:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 20:47:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 20:48:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.250.9.98
country_id: 2017370
description:
Jul 25 20:48:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.250.9.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.250.9.98
country_id: 2017370
description:
2026-07-25 20:48:33 dovecot_login authenticator failed for H=host87-250-9-098.etth.mark-itt.net ([218.92.251.198]) [87.250.9.98]:58944: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 20:49:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 20:49:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 20:49:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 20:49:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 20:50:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 20:50:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 20:51:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.206.131.33
country_id: 1269750
description:
Jul 25 20:51:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.206.131.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 20:50:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-25 20:51:10 dovecot_login authenticator failed for H=([111.53.189.3]) [103.206.131.33]:41540: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.29.219.54
country_id: 1835841
description:
Jul 25 20:51:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.29.219.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.29.219.54
country_id: 1835841
description:
2026-07-25 20:51:32 dovecot_login authenticator failed for H=(abts-mp-static-245.197.168.122.airtelbroadband.in) [59.29.219.54]:50652: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.62.73.218
country_id: 1835841
description:
Jul 25 20:52:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.62.73.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.62.73.218
country_id: 1835841
description:
2026-07-25 20:52:47 dovecot_login authenticator failed for H=([144.24.209.174]) [211.62.73.218]:54246: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 20:52:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.15.224.102
country_id: 1814991
description:
2026-07-25 20:53:08 dovecot_login authenticator failed for H=([50.231.243.28]) [218.15.224.102]:49597: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.15.224.102
country_id: 1814991
description:
Jul 25 20:53:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.15.224.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 20:53:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 20:53:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.228.242
country_id: 1036973
description:
Jul 25 20:53:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.228.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-25 20:53:28 dovecot_login authenticator failed for H=([104.37.135.150]) [197.219.228.242]:58924: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.123
country_id: 2017370
description:
Jul 25 20:53:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.123
country_id: 2017370
description:
2026-07-25 20:53:39 dovecot_login authenticator failed for H=([142.54.239.4]) [178.178.194.123]:50074: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 20:53:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-25 20:54:39 dovecot_login authenticator failed for H=(220-240-104-100.tpgi.com.au) [38.108.83.2]:22226: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 20:54:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 20:54:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 20:54:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 20:54:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.108.83.2
country_id: 6251999
description:
Jul 25 20:54:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.108.83.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 20:55:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.13
country_id: 6252001
description:
Jul 25 20:55:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.209.50
country_id: 1835841
description:
2026-07-25 20:55:24 dovecot_login authenticator failed for H=([223.167.75.86]) [182.31.209.50]:42465: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.31.209.50
country_id: 1835841
description:
Jul 25 20:55:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.31.209.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 20:56:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 20:57:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 20:57:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 21:00:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.41
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-00.91.243.81.41||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 21:01:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 21:01:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 21:02:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 21:02:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.29.38.71
country_id: 2017370
description:
2026-07-25 21:02:50 dovecot_login authenticator failed for H=94-29-38-71.dynamic.spd-mgts.ru (ip-68-71-242-113.hosts.zerolag.com) [94.29.38.71]:55243: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.90.248.108
country_id: 1814991
description:
Jul 25 21:03:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.90.248.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.29.38.71
country_id: 2017370
description:
Jul 25 21:02:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.29.38.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 21:02:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 21:02:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.90.248.108
country_id: 1814991
description:
2026-07-25 21:03:10 dovecot_login authenticator failed for H=([106.0.166.123]) [182.90.248.108]:29234: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.119.74.228
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ahsmarine/public_html/wp-content/uploads/admin.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.116.141.82
country_id: 1814991
description:
Jul 25 21:03:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.116.141.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 21:03:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 21:03:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.141.82
country_id: 1814991
description:
2026-07-25 21:03:41 dovecot_login authenticator failed for H=(111-70-23-254.emome-ip.hinet.net) [123.116.141.82]:60535: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 21:04:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.141
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-05.51.15.225.141||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 21:05:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 21:05:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 21:06:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2026-07-25 21:07:06 dovecot_login authenticator failed for H=([109.233.21.109]) [186.239.41.74]:46010: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 21:06:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 21:06:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.7.254
country_id: 1668284
description:
2026-07-25 21:06:52 dovecot_login authenticator failed for H=111-70-7-254.emome-ip.hinet.net ([195.222.57.183]) [111.70.7.254]:36370: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 21:06:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Jul 25 21:07:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 21:06:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jul 25 21:06:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.7.254
country_id: 1668284
description:
Jul 25 21:06:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.7.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 21:06:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.235.106
country_id: 1835841
description:
Jul 25 21:06:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.235.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.235.106
country_id: 1835841
description:
2026-07-25 21:06:52 dovecot_login authenticator failed for H=([115.241.228.34]) [125.143.235.106]:60808: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 21:07:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 21:07:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 21:07:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 21:07:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 21:07:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-25 21:07:19 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [94.16.17.139]:33922: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
country_id: 1668284
description:
2026-07-25 21:08:11 dovecot_login authenticator failed for H=111-70-32-5.emome-ip.hinet.net ([186.238.52.128]) [111.70.32.5]:47170: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 21:08:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.56.179.201
country_id: 1814991
description:
Jul 25 21:08:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.56.179.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.56.179.201
country_id: 1814991
description:
2026-07-25 21:08:29 dovecot_login authenticator failed for H=([49.124.151.69]) [183.56.179.201]:57348: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.76.221.51
country_id: 1835841
description:
Jul 25 21:08:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.76.221.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.76.221.51
country_id: 1835841
description:
2026-07-25 21:08:44 dovecot_login authenticator failed for H=(110-25-112-132.adsl.fetnet.net) [61.76.221.51]:2566: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.190.152
country_id: 3469034
description:
Jul 25 21:08:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.190.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.74.85.184
country_id: 1880251
description:
Jul 25 21:08:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.74.85.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 21:08:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.5
country_id: 1668284
description:
Jul 25 21:08:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.190.152
country_id: 3469034
description:
2026-07-25 21:08:57 dovecot_login authenticator failed for H=(syn-137-027-032-070.biz.spectrum.com) [131.0.190.152]:44951: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 21:09:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 21:10:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 21:10:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 21:10:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 21:11:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 21:12:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 21:13:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 21:12:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.230.76
country_id: 1814991
description:
Jul 25 21:13:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.230.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-25 21:14:01 dovecot_login authenticator failed for H=(mx-ll-180.183.245-232.dynamic.3bb.in.th) [182.95.119.30]:51570: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.230.76
country_id: 1814991
description:
2026-07-25 21:13:47 dovecot_login authenticator failed for H=(ip-178-46-128-225.dsl.surnet.ru) [218.25.230.76]:34102: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 21:13:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.119.30
country_id: 1269750
description:
Jul 25 21:13:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.119.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 21:14:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 21:14:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 21:14:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 51.116.233.22
country_id: 2921044
domain: metrodigitals.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/metrodigitals/public_html/wp-includes||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.33.44
country_id: 2017370
description:
Jul 25 21:14:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.33.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 21:14:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.120.42.31
country_id: 1733045
description:
2026-07-25 21:16:39 dovecot_login authenticator failed for H=([1.227.135.190]) [121.120.42.31]:50470: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 21:16:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.187.230.168
country_id: 298795
description:
Jul 25 21:16:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.187.230.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-25 21:16:53 dovecot_login authenticator failed for H=([174.75.211.204]) [78.187.230.168]:49577: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 21:17:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 21:18:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 21:18:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.199.84.185
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-18.91.199.84.185||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 21:18:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 21:20:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.181.138
country_id: 1269750
description:
Jul 25 21:20:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.181.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-25 21:20:54 dovecot_login authenticator failed for H=(ticons.static.gvt.net.br) [182.95.181.138]:33388: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 87.121.33.27
country_id: 2077456
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-20.87.121.33.27||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 21:20:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jul 25 21:21:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.63.248
country_id: 6252001
description:
[2026-07-25 21:21:15 +0530] info [whostmgrd] 146.190.63.248 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 21:22:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 21:22:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 21:22:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 21:23:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 21:23:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.50.190
country_id: 1880251
description:
Jul 25 21:23:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.50.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 21:24:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 21:24:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 21:25:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 21:25:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 21:25:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 21:25:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-25 21:26:27 dovecot_login authenticator failed for H=([49.124.149.53]) [197.242.170.10]:64488: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 21:26:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.245.184.230
country_id: 2017370
description:
Jul 25 21:26:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.245.184.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.245.184.230
country_id: 2017370
description:
2026-07-25 21:26:40 dovecot_login authenticator failed for H=([62.182.132.94]) [185.245.184.230]:54840: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 21:26:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 21:26:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 21:27:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 21:27:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 25 21:27:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 21:28:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 21:28:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 21:28:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.93.197
country_id: 1814991
description:
Jul 25 21:29:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.93.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.93.197
country_id: 1814991
description:
2026-07-25 21:29:18 dovecot_login authenticator failed for H=([49.124.133.224]) [117.159.93.197]:50777: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 21:29:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 21:29:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-07-25 21:29:47 dovecot_login authenticator failed for H=([163.223.244.3]) [128.185.12.179]:47384: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.129
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-30.91.243.81.129||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 21:30:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 21:30:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 21:31:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 21:31:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 21:32:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 21:32:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 21:33:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 21:33:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 21:33:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.179
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-34.45.135.228.179||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 21:33:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.14.47.121
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-33.185.14.47.121||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 21:34:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 21:34:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 21:34:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.159.179.93
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-34.51.159.179.93||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 21:34:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.13
country_id: 6252001
description:
Jul 25 21:36:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 21:36:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 21:36:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.52.54.143
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/cochinbigbandsho/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 21:37:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 21:39:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 21:40:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.177
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-39.62.112.222.177||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 21:39:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 21:39:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.39.70.85
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-39.89.39.70.85||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 21:41:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jul 25 21:41:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 21:42:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 21:43:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 21:43:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 21:43:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 21:43:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 21:43:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 21:43:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 21:44:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.137.185
country_id: 2017370
description:
2026-07-25 21:45:55 dovecot_login authenticator failed for H=broadband-95-84-137-185.ip.moscow.rt.ru ([20.224.41.181]) [95.84.137.185]:56866: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.137.185
country_id: 2017370
description:
Jul 25 21:45:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.137.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://www.ttv-burgstaedt.de/gaestebuch?1360\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.62.73.218
country_id: 1835841
description:
Jul 25 21:46:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.62.73.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.62.73.218
country_id: 1835841
description:
2026-07-25 21:46:10 dovecot_login authenticator failed for H=([142.54.231.33]) [211.62.73.218]:53666: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 195.178.110.211
country_id: 732800
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/debug.log||User:vrishenterprises||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 21:53:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-25 21:53:53 dovecot_login authenticator failed for H=([192.252.208.66]) [185.15.82.135]:50485: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.51.12.142
country_id: 1835841
description:
Jul 25 21:53:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.51.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-25 21:53:18 dovecot_login authenticator failed for H=([116.113.241.82]) [14.51.12.142]:56302: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
country_id: 1814991
description:
Jul 25 21:54:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
country_id: 1814991
description:
2026-07-25 21:54:12 dovecot_login authenticator failed for H=([125.20.230.46]) [182.139.39.150]:39994: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 21:55:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 21:57:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-25 21:58:06 dovecot_login authenticator failed for H=(111-70-29-130.emome-ip.hinet.net) [125.23.228.86]:53186: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.212.91.18
country_id: 1814991
description:
Jul 25 21:57:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.212.91.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.212.91.18
country_id: 1814991
description:
2026-07-25 21:57:50 dovecot_login authenticator failed for H=([125.88.160.13]) [222.212.91.18]:57080: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.228.86
country_id: 1269750
description:
Jul 25 21:58:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.228.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-07-25 21:58:43 dovecot_login authenticator failed for H=([89.32.197.160]) [1.241.64.237]:44422: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.73.22
country_id: 1835841
description:
2026-07-25 21:58:49 dovecot_login authenticator failed for H=(activox.static.gvt.net.br) [58.65.73.22]:46051: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.223
country_id: 1733045
description:
2026-07-25 21:58:26 dovecot_login authenticator failed for H=([101.13.5.49]) [49.124.152.223]:37188: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.99.79.157
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-59.194.99.79.157||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.56.12
country_id: 1269750
description:
Jul 25 21:59:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.56.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-25 21:59:13 dovecot_login authenticator failed for H=([49.125.201.68]) [183.82.56.12]:52505: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.38.136.211
country_id: 1814991
description:
2026-07-25 22:00:28 dovecot_login authenticator failed for H=(net-188-219-104-210.cust.vodafonedsl.it) [111.38.136.211]:41920: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.38.136.211
country_id: 1814991
description:
Jul 25 22:00:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.38.136.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.8.226.227
country_id: 2017370
description:
Jul 25 22:00:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.8.226.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.8.226.227
country_id: 2017370
description:
2026-07-25 22:00:41 dovecot_login authenticator failed for H=(217.42.246.220.static.netvigator.com) [217.8.226.227]:59645: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.159.179.93
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-02.51.159.179.93||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 22:01:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.9.247.58
country_id: 3469034
description:
Jul 25 22:03:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.9.247.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-07-25 22:03:43 dovecot_login authenticator failed for H=(136-34-252-154.googlefiber.net) [187.9.247.58]:42744: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.167.120
country_id: 1814991
description:
Jul 25 22:03:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.167.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.167.120
country_id: 1814991
description:
2026-07-25 22:04:00 dovecot_login authenticator failed for H=([213.235.25.2]) [112.31.167.120]:36378: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.245
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-04.149.34.251.245||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 22:06:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 22:07:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.222.124.164
country_id: 1814991
description:
Jul 25 22:08:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.222.124.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.149.15.47
country_id: 1814991
description:
2026-07-25 22:09:06 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [61.149.15.47]:50210: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.222.124.164
country_id: 1814991
description:
2026-07-25 22:08:47 dovecot_login authenticator failed for H=(broadband-109-173-39-103.ip.moscow.rt.ru) [222.222.124.164]:53510: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.149.15.47
country_id: 1814991
description:
Jul 25 22:09:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.149.15.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.131.5
country_id: 2077456
description:
Jul 25 22:08:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.131.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.131.5
country_id: 2077456
description:
2026-07-25 22:08:30 dovecot_login authenticator failed for H=182-239-131-5.tpgi.com.au ([213.230.64.246]) [182.239.131.5]:33641: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.28.215
country_id: 1269750
description:
Jul 25 22:09:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.28.215 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.39.70.233
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-09.89.39.70.233||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.115.219.90
country_id: 1814991
description:
2026-07-25 22:09:40 dovecot_login authenticator failed for H=([46.163.174.216]) [49.115.219.90]:37908: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.115.219.90
country_id: 1814991
description:
Jul 25 22:09:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.115.219.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.28.215
country_id: 1269750
description:
2026-07-25 22:09:52 dovecot_login authenticator failed for H=([49.124.149.50]) [49.206.28.215]:42666: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 22:11:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 22:12:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.141
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-13.51.15.225.141||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:15:35 dovecot_login authenticator failed for H=(fdofEUOTl) [64.89.161.12]:59720: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.14.47.209
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-15.185.14.47.209||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 93.152.205.216
country_id: 732800
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:703703.pht||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.12
country_id: 6252001
description:
Jul 25 22:15:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.12
country_id: 6252001
description:
Jul 25 22:16:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:16:11 dovecot_login authenticator failed for H=(6qcbEOui) [64.89.161.12]:53326: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.89.161.12
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[64.89.161.12] [Authentication Database]=[mail] [Username]=[jijo@ddgalaxy.in] (5/5 failures) (blocked until [Sat Jul 25 17:01:27 2026 UTC/Sat Jul 25 22:31:27 2026 LOCAL])


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.67.8.205
country_id: 1269750
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-18.152.67.8.205||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:17:26 dovecot_login authenticator failed for H=(hekWYZ6yw) [64.89.161.12]:62219: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.114.35.15
country_id: 1814991
description:
2026-07-25 22:18:06 dovecot_login authenticator failed for H=([174.64.199.85]) [122.114.35.15]:40460: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:18:20 dovecot_login authenticator failed for H=(QJ0eAw5L5) [64.89.161.12]:55465: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.60.9.114
country_id: 1814991
description:
2026-07-25 22:18:26 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [119.60.9.114]:51675: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:18:38 dovecot_login authenticator failed for H=(KKg0vx) [64.89.161.12]:56162: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 22:18:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-25 22:19:25 dovecot_login authenticator failed for H=([118.40.157.149]) [85.105.255.56]:48389: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:19:14 dovecot_login authenticator failed for H=(EdSH4UCO) [64.89.161.12]:54377: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2026-07-25 22:19:15 dovecot_login authenticator failed for H=([65.20.179.251]) [212.135.208.13]:46337: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.135.208.13
country_id: 1861060
description:
Jul 25 22:19:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.135.208.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.255.56
country_id: 298795
description:
Jul 25 22:19:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.255.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.195.41
country_id: 1814991
description:
Jul 25 22:21:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.195.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.195.41
country_id: 1814991
description:
2026-07-25 22:21:09 dovecot_login authenticator failed for H=([70.166.167.44]) [120.234.195.41]:59751: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:20:28 dovecot_login authenticator failed for H=(uAkxxw) [64.89.161.12]:58308: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.198.161.85
country_id: 1814991
description:
2026-07-25 22:22:06 dovecot_login authenticator failed for H=([47.215.0.179]) [223.198.161.85]:35369: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:21:11 dovecot_login authenticator failed for H=(EGK9ka8K) [64.89.161.12]:56735: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:22:16 dovecot_login authenticator failed for H=(bqRhSzo) [64.89.161.12]:57859: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.34.145.77
country_id: 1814991
description:
Jul 25 22:22:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.34.145.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.34.145.77
country_id: 1814991
description:
2026-07-25 22:22:20 dovecot_login authenticator failed for H=(wgpon-39181-194.wateen.net) [171.34.145.77]:42378: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:22:34 dovecot_login authenticator failed for H=(7zly2VSzsU) [64.89.161.12]:56206: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:23:10 dovecot_login authenticator failed for H=(XmpLXqsFv3) [64.89.161.12]:53747: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.89.161.12
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[64.89.161.12] [Authentication Database]=[mail] [Username]=[jijo@ddgalaxy.in] (30/30 failures) (blocked until [Sun Jul 26 16:54:02 2026 UTC/Sun Jul 26 22:24:02 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-25 22:24:49 dovecot_login authenticator failed for H=([70.166.167.49]) [207.254.29.22]:56721: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-25 22:25:00 dovecot_login authenticator failed for H=(nsg-static-201.69.75.182-airtel.com) [41.128.181.196]:40714: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 22:25:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.254.29.22
country_id: 2963597
description:
Jul 25 22:24:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.254.29.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.128.181.196
country_id: 357994
description:
Jul 25 22:24:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.128.181.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:24:22 dovecot_login authenticator failed for H=(9tqf0natDG) [64.89.161.12]:57647: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:25:16 dovecot_login authenticator failed for H=(wOQWWp) [64.89.161.12]:63623: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 87.121.33.27
country_id: 2077456
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-25.87.121.33.27||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:26:10 dovecot_login authenticator failed for H=(9OAynqaRlv) [64.89.161.12]:56149: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:26:28 dovecot_login authenticator failed for H=(ePZgJz0KZ) [64.89.161.12]:60583: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.249.88
country_id: 1269750
description:
Jul 25 22:27:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.249.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2026-07-25 22:27:08 dovecot_login authenticator failed for H=([178.217.74.104]) [122.187.249.88]:52804: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.148.207.153
country_id: 690791
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.huanshi100.com/\">\xe4\xb8\xad\xe5\x9b\xbd\xe6\x96\xb0\xe8\xa7\x86\xe7\x82\xb9\xe7\xbd\x91</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:27:22 dovecot_login authenticator failed for H=(OEGV7nP70n) [64.89.161.12]:61749: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.215.146.195
country_id: 934841
description:
Jul 25 22:27:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.215.146.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.146.195
country_id: 934841
description:
2026-07-25 22:27:26 dovecot_login authenticator failed for H=([145.249.187.244]) [41.215.146.195]:28601: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 66.163.117.58
country_id: 2635167
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-27.66.163.117.58||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:28:16 dovecot_login authenticator failed for H=(VfqdNiA) [64.89.161.12]:53377: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvacservice3.info\">https://hvacservice3.info</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.230.176.152
country_id: 1269750
description:
Jul 25 22:30:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.230.176.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 22:30:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:29:10 dovecot_login authenticator failed for H=(CAXy0Co) [64.89.161.12]:55544: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-25 22:29:53 dovecot_login authenticator failed for H=ns1.sinergi.net.id (static.ill.117.247.82.240.bsnl.co.in) [223.25.108.2]:33308: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2026-07-25 22:30:11 dovecot_login authenticator failed for H=(95-165-159-70.static.spd-mgts.ru) [103.230.176.152]:51718: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.153.164.122
country_id: 1814991
description:
Jul 25 22:30:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.153.164.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 22:30:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:30:22 dovecot_login authenticator failed for H=(IyLp0X1q) [64.89.161.12]:62596: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.153.164.122
country_id: 1814991
description:
2026-07-25 22:30:18 dovecot_login authenticator failed for H=(cm-170-253-147-12.maxxsouthbb.net) [36.153.164.122]:46095: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.171.27.248
country_id: 1814991
description:
Jul 25 22:30:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.171.27.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:30:40 dovecot_login authenticator failed for H=(s4HwFjm3ry) [64.89.161.12]:59110: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2026-07-25 22:30:39 dovecot_login authenticator failed for H=([98.182.171.163]) [116.171.27.248]:57564: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:31:16 dovecot_login authenticator failed for H=(v2KSil0Y) [64.89.161.12]:64989: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:32:10 dovecot_login authenticator failed for H=(ikErTmngN) [64.89.161.12]:58212: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 37.114.130.163
country_id: 587116
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14895.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e82a0dcbb331e4fc6066b649d20e4ff2bb81f762||Title:0xbf8a5ee4||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:33:22 dovecot_login authenticator failed for H=(zbwgNNN2) [64.89.161.12]:54306: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:34:52 dovecot_login authenticator failed for H=(mJYfsG) [64.89.161.12]:58479: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:34:16 dovecot_login authenticator failed for H=(vAq9OSZM) [64.89.161.12]:59369: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:35:28 dovecot_login authenticator failed for H=(PUMqZQyD8) [64.89.161.12]:53493: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 22:35:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:36:22 dovecot_login authenticator failed for H=(2Js488hM61) [64.89.161.12]:60349: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.39.70.85
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-36.89.39.70.85||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:37:16 dovecot_login authenticator failed for H=(H5vmUQ) [64.89.161.12]:52750: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 188.3.66.116
country_id: 298795
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11440.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6c898c44c48ebd787b566c98aeb701d0a6249b81||Title:0x9cdc58f4||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:38:13 dovecot_login authenticator failed for H=(gijUxp) [64.89.161.12]:62098: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 170.168.93.161
country_id: 2017370
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://suachuamaybienap.com/index.php/User_talk:CEKHellen915929\">\xd1\x8d\xd1\x81\xd0\xba\xd0\xbe\xd1\x80\xd1\x82 \xd1\x80\xd0\xb0\xd0\xb1\xd0\xbe\xd1\x82\xd0\xb0</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:38:32 dovecot_login authenticator failed for H=(N2eeJhAacv) [64.89.161.12]:51301: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:39:26 dovecot_login authenticator failed for H=(9ywRIbjXe) [64.89.161.12]:58990: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 22:40:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:40:20 dovecot_login authenticator failed for H=(NbFmJXL9) [64.89.161.12]:57271: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:41:14 dovecot_login authenticator failed for H=(oelNrm) [64.89.161.12]:58581: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:42:11 dovecot_login authenticator failed for H=(BcyGT80l) [64.89.161.12]:49437: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.60
country_id: 1668284
description:
2026-07-25 22:42:23 dovecot_login authenticator failed for H=111-70-34-60.emome-ip.hinet.net ([218.21.245.202]) [111.70.34.60]:43275: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.198.161.85
country_id: 1814991
description:
2026-07-25 22:42:44 dovecot_login authenticator failed for H=([142.54.239.4]) [223.198.161.85]:33900: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: www.travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceqcocmzlo.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:42:14 dovecot_login authenticator failed for H=(63Wpmq) [64.89.161.12]:49911: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.34.60
country_id: 1668284
description:
Jul 25 22:42:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.34.60 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce44mdj06u.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 22:43:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:43:34 dovecot_login authenticator failed for H=(sw2u2LR) [64.89.161.12]:61186: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:44:17 dovecot_login authenticator failed for H=(FbBZKC61) [64.89.161.12]:58338: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.107.57
country_id: 1814991
description:
Jul 25 22:45:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.107.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.107.57
country_id: 1814991
description:
2026-07-25 22:45:02 dovecot_login authenticator failed for H=([187.12.48.70]) [36.135.107.57]:38992: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:45:11 dovecot_login authenticator failed for H=(iiB8N9sC) [64.89.161.12]:49566: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.61.229
country_id: 1835841
description:
2026-07-25 22:45:31 dovecot_login authenticator failed for H=([24.249.199.26]) [121.162.61.229]:65032: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.162.61.229
country_id: 1835841
description:
Jul 25 22:45:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.162.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:46:23 dovecot_login authenticator failed for H=(YYkQBHDOBE) [64.89.161.12]:52191: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:46:41 dovecot_login authenticator failed for H=(OZmVxXXHOq) [64.89.161.12]:49947: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:47:17 dovecot_login authenticator failed for H=(WxsfbPYx9z) [64.89.161.12]:53876: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 22:47:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:48:11 dovecot_login authenticator failed for H=(lU53QoXw) [64.89.161.12]:64966: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 22:48:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2026-07-25 22:49:41 dovecot_login authenticator failed for H=([220.189.253.198]) [149.54.51.82]:41896: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.190.89.138
country_id: 6252001
description:
Jul 25 22:49:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.190.89.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-25 22:49:57 dovecot_login authenticator failed for H=([192.111.138.28]) [50.190.89.138]:48706: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:49:24 dovecot_login authenticator failed for H=(38cBKGBegG) [64.89.161.12]:51972: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.51.82
country_id: 1149361
description:
Jul 25 22:49:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.51.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:50:36 dovecot_login authenticator failed for H=(uyjprrbhW) [64.89.161.12]:60797: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:50:18 dovecot_login authenticator failed for H=(gNEDweTN) [64.89.161.12]:63634: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:51:12 dovecot_login authenticator failed for H=(9xZlKZEao) [64.89.161.12]:60746: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.67.8.205
country_id: 1269750
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-51.152.67.8.205||RSV:8.35||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.245.68.143
country_id: 1835841
description:
[2026-07-25 22:52:17 +0530] info [whostmgrd] 140.245.68.143 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:52:24 dovecot_login authenticator failed for H=(UI15pPEQ0) [64.89.161.12]:53368: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 22:52:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 22:53:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:53:18 dovecot_login authenticator failed for H=(MdZLaju0nP) [64.89.161.12]:50180: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:54:12 dovecot_login authenticator failed for H=(cP2DMQ) [64.89.161.12]:63751: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:54:48 dovecot_login authenticator failed for H=(GwE9NAgIQ) [64.89.161.12]:53433: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.232
country_id: 130758
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/images/cache.php||SC:/home/cochinbigbandsho/public_html/images/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 25 22:55:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:55:24 dovecot_login authenticator failed for H=(nFNcPW9xCA) [64.89.161.12]:54650: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-25 22:56:16 dovecot_login authenticator failed for H=([174.75.211.204]) [197.219.228.246]:33858: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:56:18 dovecot_login authenticator failed for H=(5W4vIGMR) [64.89.161.12]:49492: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.44.243.191
country_id: 1814991
description:
2026-07-25 22:56:51 dovecot_login authenticator failed for H=([70.166.167.47]) [112.44.243.191]:41678: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.44.243.191
country_id: 1814991
description:
Jul 25 22:56:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.44.243.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.228.246
country_id: 1036973
description:
Jul 25 22:56:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.228.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:57:12 dovecot_login authenticator failed for H=(L8Cb0YyV) [64.89.161.12]:50931: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.210.98
country_id: 1643084
description:
[2026-07-25 22:57:44 +0530] info [whostmgrd] 157.85.210.98 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:59:00 dovecot_login authenticator failed for H=(cITC5u7) [64.89.161.12]:50130: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:58:24 dovecot_login authenticator failed for H=(7KLBKmFk5) [64.89.161.12]:57099: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.157.133.155
country_id: 1835841
description:
Jul 25 22:58:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.157.133.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.157.133.155
country_id: 1835841
description:
2026-07-25 22:58:30 dovecot_login authenticator failed for H=([192.111.134.12]) [218.157.133.155]:42590: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.230.76
country_id: 1814991
description:
2026-07-25 22:59:19 dovecot_login authenticator failed for H=([211.116.107.222]) [218.25.230.76]:36598: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.195.31.217
country_id: 1814991
description:
Jul 25 23:00:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.195.31.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.195.31.217
country_id: 1814991
description:
2026-07-25 23:00:09 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [120.195.31.217]:38276: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 46.202.227.109
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.35||T:APACHE||RA:46.202.227.109||TA:46.202.227.109||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.216.198.132
country_id: 630336
description:
Jul 25 22:59:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.216.198.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2026-07-25 22:59:39 dovecot_login authenticator failed for H=([94.16.17.140]) [46.8.246.27]:56756: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.8.246.27
country_id: 2017370
description:
Jul 25 22:59:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.8.246.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:59:18 dovecot_login authenticator failed for H=(7H2gwF3Pn) [64.89.161.12]:63207: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.230.76
country_id: 1814991
description:
Jul 25 22:59:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.230.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.216.198.132
country_id: 630336
description:
2026-07-25 22:59:35 dovecot_login authenticator failed for H=([183.241.254.124]) [46.216.198.132]:39500: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.141
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-00.51.15.225.141||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:00:15 dovecot_login authenticator failed for H=(BD2o8z0u) [64.89.161.12]:60108: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 23:01:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 23:01:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:01:27 dovecot_login authenticator failed for H=(NcuptSnA6z) [64.89.161.12]:59573: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:02:24 dovecot_login authenticator failed for H=(GZBUpY7q) [64.89.161.12]:63896: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:02:42 dovecot_login authenticator failed for H=(OpRfuKqFL) [64.89.161.12]:50383: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:03:18 dovecot_login authenticator failed for H=(0kD0LrZR2X) [64.89.161.12]:63584: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:04:18 dovecot_login authenticator failed for H=(mraIC6PtVI) [64.89.161.12]:63750: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 23:05:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:05:12 dovecot_login authenticator failed for H=(ODUqzgICyt) [64.89.161.12]:60483: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.242.194
country_id: 3469034
description:
2026-07-25 23:05:32 dovecot_login authenticator failed for H=([70.166.167.48]) [186.238.242.194]:34708: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.36.139.231
country_id: 690791
description:
Jul 25 23:05:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.36.139.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.36.139.231
country_id: 690791
description:
2026-07-25 23:05:41 dovecot_login authenticator failed for H=host-176-36-139-231.b024.la.net.ua ([38.141.252.55]) [176.36.139.231]:54584: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.242.194
country_id: 3469034
description:
Jul 25 23:05:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.242.194 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.244.208.126
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-05.185.244.208.126||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:06:13 dovecot_login authenticator failed for H=(SRzTWO) [64.89.161.12]:59117: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:06:31 dovecot_login authenticator failed for H=(dbzC0YF) [64.89.161.12]:50665: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 23:07:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:07:25 dovecot_login authenticator failed for H=(a01muw09mg) [64.89.161.12]:57071: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.244.208.42
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-07.185.244.208.42||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.56.12
country_id: 1269750
description:
Jul 25 23:08:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.56.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.107.180
country_id: 1269750
description:
Jul 25 23:08:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.107.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-25 23:09:00 dovecot_login authenticator failed for H=([206.220.175.5]) [117.250.107.180]:36173: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:08:19 dovecot_login authenticator failed for H=(lgtAQoNC) [64.89.161.12]:51709: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-25 23:08:30 dovecot_login authenticator failed for H=([112.46.138.214]) [183.82.56.12]:53835: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:09:13 dovecot_login authenticator failed for H=(xjGpjem) [64.89.161.12]:50316: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 23:09:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:10:25 dovecot_login authenticator failed for H=(3atXSwumu) [64.89.161.12]:55168: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:10:43 dovecot_login authenticator failed for H=(3ZJfT3ZFA) [64.89.161.12]:51359: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:11:19 dovecot_login authenticator failed for H=(65fE7iEa) [64.89.161.12]:63311: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.148
country_id: 1835841
description:
Jul 25 23:11:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.148
country_id: 1835841
description:
2026-07-25 23:11:39 dovecot_login authenticator failed for H=([122.114.35.55]) [218.149.228.148]:35480: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.236.102
country_id: 1814991
description:
Jul 25 23:11:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.92.236.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.236.102
country_id: 1814991
description:
2026-07-25 23:11:56 dovecot_login authenticator failed for H=([49.124.149.218]) [218.92.236.102]:38004: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.87.186
country_id: 1814991
description:
Jul 25 23:12:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.87.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.87.186
country_id: 1814991
description:
2026-07-25 23:12:20 dovecot_login authenticator failed for H=(107-135-117-245.lightspeed.livnmi.sbcglobal.net) [118.122.87.186]:38068: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.15.224.102
country_id: 1814991
description:
Jul 25 23:12:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.15.224.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.15.224.102
country_id: 1814991
description:
2026-07-25 23:12:51 dovecot_login authenticator failed for H=([95.52.199.137]) [218.15.224.102]:53898: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:12:13 dovecot_login authenticator failed for H=(VOqePDKvS) [64.89.161.12]:58983: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:13:25 dovecot_login authenticator failed for H=(JD61aN) [64.89.161.12]:50356: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:14:37 dovecot_login authenticator failed for H=(DoIwtUGf) [64.89.161.12]:55009: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
country_id: 2921044
description:
Jul 25 23:14:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:14:19 dovecot_login authenticator failed for H=(j4LxBMr) [64.89.161.12]:50588: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.95.9
country_id: 1814991
description:
Jul 25 23:14:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.95.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-25 23:15:01 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([183.241.254.124]) [93.241.232.14]:45765: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.9
country_id: 1814991
description:
2026-07-25 23:14:47 dovecot_login authenticator failed for H=(c-73-101-102-237.hsd1.pa.comcast.net) [218.23.95.9]:50656: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:15:13 dovecot_login authenticator failed for H=(zBE2y9eF) [64.89.161.12]:62225: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 23:16:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.26
country_id: 1668284
description:
Jul 25 23:17:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.26
country_id: 1668284
description:
2026-07-25 23:17:07 dovecot_login authenticator failed for H=(187.115.118.57.static.host.gvt.net.br) [101.13.5.26]:52254: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:16:25 dovecot_login authenticator failed for H=(D6sRnZaAy) [64.89.161.12]:58644: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.59.235.170
country_id: 1814991
description:
2026-07-25 23:17:23 dovecot_login authenticator failed for H=([49.124.146.40]) [218.59.235.170]:33299: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
country_id: 3469034
description:
Jul 25 23:17:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2026-07-25 23:18:08 dovecot_login authenticator failed for H=(a95-94-205-12.cpe.netcabo.pt) [220.80.223.144]:40832: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:17:21 dovecot_login authenticator failed for H=(WIfDZ26HWK) [64.89.161.12]:49191: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.59.235.170
country_id: 1814991
description:
Jul 25 23:17:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.59.235.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2026-07-25 23:17:51 dovecot_login authenticator failed for H=([196.219.93.108]) [191.36.154.175]:59096: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
country_id: 1835841
description:
Jul 25 23:18:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:18:18 dovecot_login authenticator failed for H=(UyLQc2302F) [64.89.161.12]:58286: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.48.136.184
country_id: 1835841
description:
2026-07-25 23:18:31 dovecot_login authenticator failed for H=([219.144.16.16]) [118.48.136.184]:33501: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.39.70.85
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-18.89.39.70.85||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:18:54 dovecot_login authenticator failed for H=(M80OTQ) [64.89.161.12]:63435: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 23:20:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:19:12 dovecot_login authenticator failed for H=(ujcfK0nEPX) [64.89.161.12]:50699: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 25 23:20:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:20:24 dovecot_login authenticator failed for H=(07w5dCTCru) [64.89.161.12]:58444: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:21:10 dovecot_login authenticator failed for H=(yV9cF5U7) [64.89.161.12]:62877: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-25 23:21:47 dovecot_login authenticator failed for H=(181-212-174-166.baf.movistar.cl) [196.188.93.169]:5477: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 205.250.25.62
country_id: 6251999
description:
Jul 25 23:22:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 205.250.25.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:22:33 dovecot_login authenticator failed for H=(0tNh0VpbmG) [64.89.161.12]:57423: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.141
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-22.51.15.225.141||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:22:15 dovecot_login authenticator failed for H=(ZqAHrBJLX) [64.89.161.12]:56906: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-25 23:22:22 dovecot_login authenticator failed for H=(c-71-235-27-139.hsd1.vt.comcast.net) [205.250.25.62]:45604: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 23:22:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-25 23:23:58 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [64.72.74.162]:57825: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:23:27 dovecot_login authenticator failed for H=(lKPHVj3) [64.89.161.12]:50855: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Jul 25 23:23:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
country_id: 1562822
description:
2026-07-25 23:24:29 dovecot_login authenticator failed for H=([218.94.115.164]) [210.245.95.11]:49080: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.20.73.26
country_id: 1814991
description:
2026-07-25 23:24:46 dovecot_login authenticator failed for H=([125.72.150.250]) [14.20.73.26]:38913: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.14.144.138
country_id: 3017382
description:
Jul 25 23:24:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.14.144.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:24:21 dovecot_login authenticator failed for H=(vxD3wN7DN) [64.89.161.12]:64940: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.20.73.26
country_id: 1814991
description:
Jul 25 23:24:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.20.73.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.14.144.138
country_id: 3017382
description:
2026-07-25 23:24:14 dovecot_login authenticator failed for H=([45.178.227.128]) [154.14.144.138]:55068: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:25:10 dovecot_login authenticator failed for H=(Z9W3M3a) [64.89.161.12]:56446: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 23:25:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 23:26:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:25:57 dovecot_login authenticator failed for H=(SWhpaRn) [64.89.161.12]:62287: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:26:15 dovecot_login authenticator failed for H=(IBkPMX5) [64.89.161.12]:49519: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:27:27 dovecot_login authenticator failed for H=(pXuG8S) [64.89.161.12]:53312: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.118.24.100
country_id: 1835841
description:
2026-07-25 23:28:33 dovecot_login authenticator failed for H=(197-90-131-158.mweb.ipv4.as20011.net) [39.118.24.100]:49368: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.161.168
country_id: 1835841
description:
2026-07-25 23:28:54 dovecot_login authenticator failed for H=([24.249.199.26]) [61.80.161.168]:35217: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-07-25 23:28:58 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [138.118.215.192]:45546: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:28:21 dovecot_login authenticator failed for H=(CKF7cc) [64.89.161.12]:56737: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.118.24.100
country_id: 1835841
description:
Jul 25 23:28:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.118.24.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.80.161.168
country_id: 1835841
description:
Jul 25 23:28:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.80.161.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-25 23:29:13 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [196.188.93.169]:2500: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2026-07-25 23:30:09 dovecot_login authenticator failed for H=(187.115.118.57.static.host.gvt.net.br) [200.199.32.174]:43399: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:29:15 dovecot_login authenticator failed for H=(JhWgYqGcXw) [64.89.161.12]:62242: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.18.106.54
country_id: 6252001
description:
Jul 25 23:29:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.18.106.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.18.106.54
country_id: 6252001
description:
2026-07-25 23:29:56 dovecot_login authenticator failed for H=(syn-107-144-132-045.biz.spectrum.com) [173.18.106.54]:53020: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.244.208.64
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-30.185.244.208.64||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:30:09 dovecot_login authenticator failed for H=(XIVw3VyY) [64.89.161.12]:64873: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:30:27 dovecot_login authenticator failed for H=(EnzdXbbzL) [64.89.161.12]:56573: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:31:21 dovecot_login authenticator failed for H=(XqSIsI) [64.89.161.12]:55078: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:32:15 dovecot_login authenticator failed for H=(wl0o15Z) [64.89.161.12]:50020: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.228.162.19
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-33.152.228.162.19||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:33:27 dovecot_login authenticator failed for H=(dzfQhOoL) [64.89.161.12]:58312: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:34:39 dovecot_login authenticator failed for H=(pr8CgWq) [64.89.161.12]:58414: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:34:21 dovecot_login authenticator failed for H=(pzuJiWGs5) [64.89.161.12]:49325: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:35:15 dovecot_login authenticator failed for H=(P29gDDmk) [64.89.161.12]:63439: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.144.24.198
country_id: 3017382
description:
Jul 25 23:35:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.144.24.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.144.24.198
country_id: 3017382
description:
2026-07-25 23:35:43 dovecot_login authenticator failed for H=([49.124.152.241]) [185.144.24.198]:53160: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.251.249.117
country_id: 2300660
description:
Jul 25 23:36:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.251.249.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.117
country_id: 2300660
description:
2026-07-25 23:36:03 dovecot_login authenticator failed for H=([85.30.248.213]) [197.251.249.117]:36206: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:36:27 dovecot_login authenticator failed for H=(pBDtDf9) [64.89.161.12]:57107: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.93.206
country_id: 1835841
description:
Jul 25 23:37:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.93.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.62.136.109
country_id: 3686110
description:
Jul 25 23:38:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.62.136.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-25 23:38:08 dovecot_login authenticator failed for H=([192.34.164.13]) [206.62.136.109]:45860: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:37:21 dovecot_login authenticator failed for H=(seMVaWPw8k) [64.89.161.12]:58529: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-25 23:37:46 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [218.156.93.206]:47319: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.132.228.114
country_id: 1814991
description:
Jul 25 23:38:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.132.228.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.132.228.114
country_id: 1814991
description:
2026-07-25 23:38:21 dovecot_login authenticator failed for H=([36.135.103.29]) [36.132.228.114]:14594: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.4
country_id: 1835841
description:
Jul 25 23:38:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:38:15 dovecot_login authenticator failed for H=(kV76iG62) [64.89.161.12]:58888: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2026-07-25 23:38:24 dovecot_login authenticator failed for H=([222.92.61.242]) [203.252.10.4]:45516: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:38:33 dovecot_login authenticator failed for H=(AjpY7F0KgR) [64.89.161.12]:64959: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:39:27 dovecot_login authenticator failed for H=(fofXsG) [64.89.161.12]:56159: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 23:39:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.111
country_id: 1814991
description:
2026-07-25 23:41:09 dovecot_login authenticator failed for H=(centavo.ddsfma.uz) [27.24.141.111]:33786: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:40:21 dovecot_login authenticator failed for H=(3Hvtsc) [64.89.161.12]:59492: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.124.244.36
country_id: 2658434
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-40.138.124.244.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.111
country_id: 1814991
description:
Jul 25 23:41:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 23:40:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.141
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-41.51.15.225.141||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.229.151.107
country_id: 3865483
description:
2026-07-25 23:41:31 dovecot_login authenticator failed for H=([222.118.247.66]) [181.229.151.107]:9505: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:41:16 dovecot_login authenticator failed for H=(Mt6RGP) [64.89.161.12]:61582: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:42:13 dovecot_login authenticator failed for H=(gSDcfB) [64.89.161.12]:61407: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:42:20 dovecot_login authenticator failed for H=(C0DkJ0l3) [64.89.161.12]:59093: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 23:43:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:43:25 dovecot_login authenticator failed for H=(vWitAETAX) [64.89.161.12]:60320: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.39.70.208
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-44.89.39.70.208||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.95.250
country_id: 1814991
description:
Jul 25 23:44:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.95.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 23:44:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
country_id: 1814991
description:
2026-07-25 23:44:57 dovecot_login authenticator failed for H=([61.143.227.17]) [113.140.95.250]:35203: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:44:19 dovecot_login authenticator failed for H=(zLXzt7U8) [64.89.161.12]:53965: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:46:10 dovecot_login authenticator failed for H=(9Ujen5I) [64.89.161.12]:57422: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:45:13 dovecot_login authenticator failed for H=(XaYdkzI) [64.89.161.12]:52338: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 25 23:45:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.178.27
country_id: 298795
description:
Jul 25 23:45:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.178.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.244.208.209
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-46.185.244.208.209||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.27
country_id: 298795
description:
2026-07-25 23:45:26 dovecot_login authenticator failed for H=([117.34.210.196]) [188.59.178.27]:33028: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.104.127.49
country_id: 1269750
description:
2026-07-25 23:45:49 dovecot_login authenticator failed for H=(2-74-192-250.kcell.kz) [103.104.127.49]:3874: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:46:13 dovecot_login authenticator failed for H=(zdBwTbV6xD) [64.89.161.12]:51865: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 81.28.13.48
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-46.81.28.13.48||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:47:28 dovecot_login authenticator failed for H=(qx0rkx) [64.89.161.12]:51199: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:48:22 dovecot_login authenticator failed for H=(MMwqWo0A) [64.89.161.12]:55997: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:49:52 dovecot_login authenticator failed for H=(fzXadOJM) [64.89.161.12]:52968: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:49:16 dovecot_login authenticator failed for H=(SldoNz) [64.89.161.12]:55536: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.22.87.204
country_id: 1861060
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-49.149.22.87.204||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:50:28 dovecot_login authenticator failed for H=(Dfv8vOKM) [64.89.161.12]:58195: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.27.32.70
country_id: 6252001
description:
Jul 25 23:51:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.27.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.241.228.34
country_id: 1269750
description:
Jul 25 23:51:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.241.228.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2026-07-25 23:51:42 dovecot_login authenticator failed for H=([102.90.34.90]) [115.241.228.34]:37258: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-25 23:51:47 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([180.188.253.150]) [65.73.230.102]:45046: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2026-07-25 23:51:16 dovecot_login authenticator failed for H=syn-137-027-032-070.biz.spectrum.com ([175.206.113.91]) [137.27.32.70]:42304: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.66.197.199
country_id: 2661886
description:
Jul 25 23:52:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.66.197.199 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.39.70.208
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-52.89.39.70.208||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:51:22 dovecot_login authenticator failed for H=(Y7XeDM9) [64.89.161.12]:58973: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.73.230.102
country_id: 6252001
description:
Jul 25 23:51:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.73.230.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-25 23:52:06 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([36.137.38.119]) [213.66.197.199]:57586: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:52:16 dovecot_login authenticator failed for H=(V3llFxC8c) [64.89.161.12]:54328: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.52.54.143
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/min.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.52.54.143
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/min.php||SC:/home/cochinbigbandsho/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:53:28 dovecot_login authenticator failed for H=(n3i1Nd8Vc) [64.89.161.12]:63815: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:54:04 dovecot_login authenticator failed for H=(pZN982m3A) [64.89.161.12]:51859: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:54:22 dovecot_login authenticator failed for H=(Brs3xO) [64.89.161.12]:63306: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:55:16 dovecot_login authenticator failed for H=(JyPl0RCw) [64.89.161.12]:54100: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:56:10 dovecot_login authenticator failed for H=(mBU6ekAkc) [64.89.161.12]:61060: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.114
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-56.91.243.81.114||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:57:23 dovecot_login authenticator failed for H=(UW4pSh9UJ) [64.89.161.12]:52727: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.244.208.229
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-57.185.244.208.229||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:58:35 dovecot_login authenticator failed for H=(J3XtwtCry) [64.89.161.12]:64262: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 23:59:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:58:17 dovecot_login authenticator failed for H=(PIxL9gmLWM) [64.89.161.12]:54366: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.113.15.74
country_id: 1814991
description:
2026-07-25 23:59:30 dovecot_login authenticator failed for H=(92x255x196x185.static-customer.kzn.ertelecom.ru) [123.113.15.74]:55000: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 23:59:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 26 00:00:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 23:59:11 dovecot_login authenticator failed for H=(RqJ4LKnn) [64.89.161.12]:61766: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.113.15.74
country_id: 1814991
description:
Jul 25 23:59:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.113.15.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.128.84.224
country_id: 1835841
description:
Jul 26 00:00:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.128.84.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-26 00:00:38 dovecot_login authenticator failed for H=([68.71.247.133]) [121.128.84.224]:54526: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
country_id: 1269750
description:
Jul 26 00:00:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-26 00:01:01 dovecot_login authenticator failed for H=([67.201.39.9]) [116.72.9.151]:44012: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:00:23 dovecot_login authenticator failed for H=(BVy8Ea) [64.89.161.12]:62288: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.14.161
country_id: 2017370
description:
Jul 26 00:00:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.14.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.14.161
country_id: 2017370
description:
2026-07-26 00:00:24 dovecot_login authenticator failed for H=([94.16.17.139]) [109.195.14.161]:33184: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:01:17 dovecot_login authenticator failed for H=(m7uAQX7RG) [64.89.161.12]:55487: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-26 00:01:17 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [76.49.199.97]:40336: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.152.205.216
country_id: 732800
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-01.93.152.205.216||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:02:29 dovecot_login authenticator failed for H=(Dq2c88T) [64.89.161.12]:62174: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:02:11 dovecot_login authenticator failed for H=(9w0HNi) [64.89.161.12]:52082: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:03:23 dovecot_login authenticator failed for H=(8RH0bOtod3) [64.89.161.12]:51627: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 26 00:03:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:04:21 dovecot_login authenticator failed for H=(4BfKYyw) [64.89.161.12]:58829: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:05:15 dovecot_login authenticator failed for H=(fMzUn3aSCh) [64.89.161.12]:56172: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:06:09 dovecot_login authenticator failed for H=(mx5bDJVjT) [64.89.161.12]:54091: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.28.162.110
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-05.104.28.162.110||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-26 00:06:35 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com ([221.10.221.104]) [90.230.168.26]:43204: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 26 00:06:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:06:27 dovecot_login authenticator failed for H=(JjWLasqkCj) [64.89.161.12]:52269: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
country_id: 2661886
description:
Jul 26 00:06:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.119.34
country_id: 1835841
description:
Jul 26 00:07:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.119.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.119.34
country_id: 1835841
description:
2026-07-26 00:07:12 dovecot_login authenticator failed for H=([174.75.211.211]) [118.33.119.34]:60508: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:07:21 dovecot_login authenticator failed for H=(yY1uZeUN) [64.89.161.12]:61640: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 26 00:07:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:08:21 dovecot_login authenticator failed for H=(ssAIYy) [64.89.161.12]:62771: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:09:15 dovecot_login authenticator failed for H=(yeJQwEWv) [64.89.161.12]:64742: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:09:33 dovecot_login authenticator failed for H=(jmQe7KsX) [64.89.161.12]:61943: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 26 00:09:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:10:27 dovecot_login authenticator failed for H=(d2VKr4C9) [64.89.161.12]:61948: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:11:21 dovecot_login authenticator failed for H=(wlyMBxHTQ) [64.89.161.12]:51111: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 178.232.3.250
country_id: 3144096
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:22862.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c8b82143c9802136a5e0997ec9e1aba52caf2234||Title:0x423a345a||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:12:15 dovecot_login authenticator failed for H=(hTz5Rm08v) [64.89.161.12]:56628: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:13:27 dovecot_login authenticator failed for H=(iAUQ9hQF4l) [64.89.161.12]:51186: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:13:45 dovecot_login authenticator failed for H=(QgWCSGTx) [64.89.161.12]:62436: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:14:21 dovecot_login authenticator failed for H=(SDFO9rBTe3) [64.89.161.12]:49850: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:15:15 dovecot_login authenticator failed for H=(uaZpxEe1N) [64.89.161.12]:60560: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.152.205.216
country_id: 732800
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-15.93.152.205.216||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 26 00:16:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:16:27 dovecot_login authenticator failed for H=(TzCkhsCbLL) [64.89.161.12]:50960: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:17:21 dovecot_login authenticator failed for H=(15fyS6KZ) [64.89.161.12]:62711: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:17:57 dovecot_login authenticator failed for H=(Gl3yJ2P) [64.89.161.12]:56718: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 26 00:17:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:18:15 dovecot_login authenticator failed for H=(Xv1QCAr) [64.89.161.12]:62883: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 26 00:18:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:19:27 dovecot_login authenticator failed for H=(RLlVtBl0OV) [64.89.161.12]:51954: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.251.193.6
country_id: 2300660
description:
Jul 26 00:19:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.251.193.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.193.6
country_id: 2300660
description:
2026-07-26 00:19:45 dovecot_login authenticator failed for H=([192.252.216.83]) [197.251.193.6]:60386: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.57.17.167
country_id: 1814991
description:
Jul 26 00:19:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.57.17.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.167
country_id: 1814991
description:
2026-07-26 00:19:57 dovecot_login authenticator failed for H=([49.124.151.24]) [111.57.17.167]:35648: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:20:21 dovecot_login authenticator failed for H=(KcNJhJj) [64.89.161.12]:54982: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.141
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-20.51.15.225.141||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.152.205.216
country_id: 732800
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-20.93.152.205.216||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.244.208.229
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-20.185.244.208.229||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.177.40.47
country_id: 2017370
description:
Jul 26 00:21:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.177.40.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.177.40.47
country_id: 2017370
description:
2026-07-26 00:21:09 dovecot_login authenticator failed for H=(ip157.net-193-180-125.koping.net) [178.177.40.47]:52614: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:21:15 dovecot_login authenticator failed for H=(5OvPLvSG) [64.89.161.12]:52515: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.144.79.102
country_id: 1269750
description:
Jul 26 00:21:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.144.79.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-07-26 00:21:22 dovecot_login authenticator failed for H=([174.64.199.77]) [59.144.79.102]:49962: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:22:09 dovecot_login authenticator failed for H=(Zi6bO5HGv) [64.89.161.12]:50248: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-26 00:22:27 dovecot_login authenticator failed for H=(OnCQorJ) [64.89.161.12]:60502: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.12.83.134
country_id: 3932488
description:
Jul 26 00:26:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.12.83.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.12.83.134
country_id: 3932488
description:
2026-07-26 00:26:57 dovecot_plain authenticator failed for H=(eping) [190.12.83.134]:36089: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 26 00:27:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.201.254
country_id: 1814991
description:
Jul 26 00:27:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.92.201.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.201.254
country_id: 1814991
description:
2026-07-26 00:27:03 dovecot_plain authenticator failed for H=(apper) [218.92.201.254]:2921: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 26 00:28:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 26 00:29:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.109.143
country_id: 3469034
description:
Jul 26 00:30:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.109.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.109.143
country_id: 3469034
description:
2026-07-26 00:30:48 dovecot_login authenticator failed for H=([124.205.8.130]) [177.174.109.143]:47676: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
country_id: 1814991
description:
2026-07-26 00:31:09 dovecot_login authenticator failed for H=([184.181.217.198]) [116.228.195.251]:61153: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
country_id: 1814991
description:
Jul 26 00:31:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 26 00:33:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 26 00:34:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 26 00:37:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.122.37.97
country_id: 2635167
description:
Jul 26 00:39:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.122.37.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-26 00:39:15 dovecot_login authenticator failed for H=([142.54.229.253]) [188.122.37.97]:56336: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77469916
abuser: 103.87.68.60
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-4955.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.34.145.77
country_id: 1814991
description:
2026-07-26 00:42:58 dovecot_login authenticator failed for H=([31.173.12.27]) [171.34.145.77]:57888: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.34.145.77
country_id: 1814991
description:
Jul 26 00:42:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.34.145.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.247.54.50
country_id: 2017370
description:
Jul 26 00:43:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.247.54.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.54.50
country_id: 2017370
description:
2026-07-26 00:43:07 dovecot_login authenticator failed for H=([196.189.59.226]) [188.247.54.50]:55708: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 81.28.13.48
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-45.81.28.13.48||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 26 00:49:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 26 00:50:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 26 00:50:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 26 00:52:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.125.117.54
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://vird.co/go/paitowarnahk\">Paito Warna HK Terupdate</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.246
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-51.149.34.251.246||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 199.187.210.54
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.cnfisher.com/\">\xe4\xb8\xad\xe5\x9b\xbd\xe9\x92\x93\xe9\xb1\xbc\xe4\xba\xba\xe7\xbd\x91\xe5\xae\x98\xe7\xbd\x91</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.223.184.164
country_id: 1861060
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-53.31.223.184.164||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.170
country_id: 99237
description:
Jul 26 00:55:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-07-26 00:55:23 dovecot_login authenticator failed for H=(108-90-216-10.lightspeed.rcsntx.sbcglobal.net) [65.20.251.170]:50662: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.237.90
country_id: 3469034
description:
Jul 26 00:55:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.237.90
country_id: 3469034
description:
2026-07-26 00:55:39 dovecot_login authenticator failed for H=([178.74.110.94]) [201.28.237.90]:34100: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 26 00:57:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 20.118.34.228
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/dhrxvbsl/fonts/fjatoajs.PHP||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.218.49
country_id: 3469034
description:
Jul 26 00:58:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.218.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 26 00:58:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.52.56
country_id: 6252001
description:
Jul 26 00:58:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.52.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.52.56
country_id: 6252001
description:
2026-07-26 00:58:41 dovecot_login authenticator failed for H=24-119-52-56.cpe.sparklight.net ([91.143.161.208]) [24.119.52.56]:55272: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-07-26 00:58:55 dovecot_login authenticator failed for H=(139-216-6-17.sta.dodo.net.au) [179.184.218.49]:41701: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://unblocked-games-76-77.s3.amazonaws.com/index.html\">unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.114
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-02.91.243.81.114||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.178.227.0
country_id: 3469034
description:
Jul 26 01:01:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.178.227.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.178.227.0
country_id: 3469034
description:
2026-07-26 01:01:35 dovecot_login authenticator failed for H=([49.124.147.117]) [45.178.227.0]:35117: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.132.228.114
country_id: 1814991
description:
2026-07-26 01:01:46 dovecot_login authenticator failed for H=(208-96-233-67.resi.cgocable.ca) [36.132.228.114]:5760: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.132.228.114
country_id: 1814991
description:
Jul 26 01:01:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.132.228.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.1.75
country_id: 1668284
description:
Jul 26 01:02:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.1.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.75
country_id: 1668284
description:
2026-07-26 01:02:36 dovecot_login authenticator failed for H=([111.53.189.3]) [101.13.1.75]:47886: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.81.75
country_id: 2661886
description:
Jul 26 01:02:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.81.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.81.75
country_id: 2661886
description:
2026-07-26 01:02:56 dovecot_login authenticator failed for H=31-208-81-75.cust.bredband2.com ([103.210.250.198]) [31.208.81.75]:33018: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.22.87.204
country_id: 1861060
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-03.149.22.87.204||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.13.214.18
country_id: 1814991
description:
Jul 26 01:05:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.13.214.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.13.214.18
country_id: 1814991
description:
2026-07-26 01:05:47 dovecot_login authenticator failed for H=([200.149.51.6]) [218.13.214.18]:53692: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.149.88
country_id: 294640
description:
Jul 26 01:05:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.149.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2026-07-26 01:05:58 dovecot_login authenticator failed for H=(dynamic-adsl.viettel.vn) [82.102.149.88]:45293: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.90.252
country_id: 6251999
description:
2026-07-26 01:07:07 dovecot_login authenticator failed for H=d157-90-252.home4.cgocable.net ([152.52.207.80]) [24.157.90.252]:34514: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.37.178
country_id: 1269750
description:
Jul 26 01:06:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.37.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.157.90.252
country_id: 6251999
description:
Jul 26 01:07:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.157.90.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2026-07-26 01:06:42 dovecot_login authenticator failed for H=(18776239145.telemar.net.br) [103.93.37.178]:41290: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 26 01:07:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.170
country_id: 1835841
description:
Jul 26 01:07:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.46
country_id: 1814991
description:
2026-07-26 01:07:39 dovecot_login authenticator failed for H=([146.255.228.189]) [111.26.62.46]:50040: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.170
country_id: 1835841
description:
2026-07-26 01:07:49 dovecot_login authenticator failed for H=([120.195.50.149]) [218.149.228.170]:56162: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 217.179.6.251
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-07.217.179.6.251||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.62.46
country_id: 1814991
description:
Jul 26 01:07:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.62.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-26 01:08:07 dovecot_login authenticator failed for H=([61.184.128.210]) [182.95.102.190]:57434: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.223.46.28
country_id: 1814991
description:
Jul 26 01:07:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.223.46.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.102.190
country_id: 1269750
description:
Jul 26 01:08:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.102.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.223.46.28
country_id: 1814991
description:
2026-07-26 01:07:36 dovecot_login authenticator failed for H=(177.23.136.82.voxisp.com.br) [183.223.46.28]:46864: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.104.70.143
country_id: 2017370
description:
Jul 26 01:08:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.104.70.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.104.70.143
country_id: 2017370
description:
2026-07-26 01:08:13 dovecot_login authenticator failed for H=(2-54-85-220.orange.net.il) [212.104.70.143]:39226: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.27.76.210
country_id: 3469034
description:
Jul 26 01:08:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.27.76.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-07-26 01:08:55 dovecot_login authenticator failed for H=(testmft.sedgwick.com) [177.27.76.210]:44702: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.181.210.98
country_id: 1814991
description:
Jul 26 01:09:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.181.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
country_id: 1814991
description:
2026-07-26 01:09:20 dovecot_login authenticator failed for H=(a95-94-205-12.cpe.netcabo.pt) [221.181.210.98]:33637: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 26 01:09:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.12.120
country_id: 1835841
description:
2026-07-26 01:11:02 dovecot_login authenticator failed for H=([192.111.138.28]) [121.170.12.120]:40250: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
country_id: 1835841
description:
2026-07-26 01:11:20 dovecot_login authenticator failed for H=([183.247.171.186]) [114.30.180.58]:39666: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.157
country_id: 1668284
description:
2026-07-26 01:11:24 dovecot_login authenticator failed for H=111-70-29-157.emome-ip.hinet.net ([187.93.174.51]) [111.70.29.157]:40984: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-07-26 01:11:32 dovecot_login authenticator failed for H=([183.233.85.194]) [45.82.109.136]:51248: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.7.189
country_id: 1668284
description:
Jul 26 01:11:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.7.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-26 01:12:04 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi (fiber-75.McHenry.IL.i3broadband.com) [80.223.190.179]:35646: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.30.180.58
country_id: 1835841
description:
Jul 26 01:11:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.30.180.58 has been locked due to Imunify RBL


