# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.141
country_id: 3469034
description:
Jul 25 19:02:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.75.189
country_id: 1814991
description:
2026-07-25 19:02:53 dovecot_login authenticator failed for H=([49.124.151.25]) [183.236.75.189]:34736: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.47.137.190
country_id: 1814991
description:
2026-07-25 19:03:00 dovecot_login authenticator failed for H=([103.112.224.81]) [58.47.137.190]:55534: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 19:03:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2026-07-25 19:03:39 dovecot_login authenticator failed for H=([112.24.99.134]) [195.222.57.190]:42374: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.0.140
country_id: 2017370
description:
Jul 25 19:03:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.0.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.50.190
country_id: 1880251
description:
Jul 25 19:03:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.50.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.36.139.231
country_id: 690791
description:
Jul 25 19:03:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.36.139.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.36.139.231
country_id: 690791
description:
2026-07-25 19:03:28 dovecot_login authenticator failed for H=host-176-36-139-231.b024.la.net.ua ([218.8.87.28]) [176.36.139.231]:51432: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.140
country_id: 2017370
description:
2026-07-25 19:03:41 dovecot_login authenticator failed for H=(165-173-21-44.myrepublic.com.sg) [31.173.0.140]:40554: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Jul 25 19:03:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 19:05:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 19:06:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 19:06:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 19:06:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 19:06:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.123.204.152
country_id: 1814991
description:
2026-07-25 19:08:03 dovecot_login authenticator failed for H=([111.70.49.182]) [123.123.204.152]:35075: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2026-07-25 19:07:14 dovecot_login authenticator failed for H=(139-216-6-17.sta.dodo.net.au) [196.189.126.185]:36094: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-25 19:07:27 dovecot_login authenticator failed for H=([59.17.27.137]) [121.131.220.168]:43829: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.209.208
country_id: 1835841
description:
Jul 25 19:08:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.209.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-25 19:08:15 dovecot_login authenticator failed for H=([185.112.148.66]) [14.35.209.208]:40394: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.183.41.113
country_id: 1269750
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10178.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f515e52dc2efa3f8b20d05d5fc89e99eb4c6ace9||Title:0x1867a1b8||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 19:09:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
country_id: 2017370
description:
2026-07-25 19:10:27 dovecot_login authenticator failed for H=(biophormula.static.gvt.net.br) [178.178.222.58]:46890: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 19:10:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 19:10:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.88.174.143
country_id: 1814991
description:
Jul 25 19:11:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.88.174.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.88.174.143
country_id: 1814991
description:
2026-07-25 19:11:07 dovecot_login authenticator failed for H=(n233-h209.a-tc.net) [124.88.174.143]:40642: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
country_id: 2017370
description:
Jul 25 19:10:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.46.239.198
country_id: 1814991
description:
Jul 25 19:11:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.46.239.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.46.239.198
country_id: 1814991
description:
2026-07-25 19:11:23 dovecot_login authenticator failed for H=([192.111.134.12]) [121.46.239.198]:63756: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 19:11:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 19:11:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 19:11:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.190.152
country_id: 3469034
description:
Jul 25 19:12:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.190.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 19:12:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.23.3.146
country_id: 1835841
description:
Jul 25 19:12:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.23.3.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 19:12:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-25 19:12:39 dovecot_login authenticator failed for H=([1.240.101.2]) [59.23.3.146]:42564: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 19:12:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.190.152
country_id: 3469034
description:
2026-07-25 19:12:16 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [131.0.190.152]:41682: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.173.39.103
country_id: 2017370
description:
2026-07-25 19:13:19 dovecot_plain authenticator failed for H=broadband-109-173-39-103.ip.moscow.rt.ru (debutoce) [109.173.39.103]:46654: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 19:13:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 19:14:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 19:14:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 19:15:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 19:15:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 19:15:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 19:16:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jul 25 19:16:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 19:16:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.227.77
country_id: 3469034
description:
Jul 25 19:17:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.227.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 19:17:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.245
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-17.149.34.251.245||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.207.66.154
country_id: 6251999
description:
Jul 25 19:17:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.207.66.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-25 19:17:25 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca ([142.54.231.33]) [24.207.66.154]:32908: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
country_id: 3469034
description:
2026-07-25 19:17:42 dovecot_login authenticator failed for H=([60.171.135.254]) [179.185.227.77]:39795: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 19:18:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 19:18:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 19:19:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jul 25 19:19:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 19:19:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 19:19:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 19:19:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 19:19:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 19:20:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 19:20:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 19:22:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 19:22:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 19:23:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 19:23:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 19:24:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 19:23:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 19:24:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.183.82.70
country_id: 2017370
description:
Jul 25 19:25:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.183.82.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.183.82.70
country_id: 2017370
description:
2026-07-25 19:25:42 dovecot_login authenticator failed for H=([49.124.131.245]) [62.183.82.70]:51888: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.15.149.254
country_id: 3469034
description:
Jul 25 19:26:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.15.149.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 19:25:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 19:25:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.24.185.98
country_id: 2017370
description:
Jul 25 19:26:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.24.185.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
country_id: 2017370
description:
2026-07-25 19:26:25 dovecot_login authenticator failed for H=([94.16.17.141]) [217.24.185.98]:39852: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 19:26:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
country_id: 1814991
description:
Jul 25 19:26:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
country_id: 1814991
description:
2026-07-25 19:26:59 dovecot_login authenticator failed for H=([111.70.49.183]) [116.228.195.251]:11678: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 25 19:27:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2026-07-25 19:26:10 dovecot_login authenticator failed for H=(atlanta-1.cdn77.com) [201.15.149.254]:60425: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.17.217.141
country_id: 1814991
description:
2026-07-25 19:27:22 dovecot_login authenticator failed for H=([113.53.251.101]) [218.17.217.141]:31358: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 19:27:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 25 19:27:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 19:27:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jul 25 19:27:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.17.217.141
country_id: 1814991
description:
Jul 25 19:27:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.17.217.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 19:28:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 68.221.130.241
country_id: 2510769
domain: yukticlick.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/yukticlick/public_html/wp-includes||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 19:28:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 19:28:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 19:28:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.169.239.198
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-28.193.169.239.198||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 19:29:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 19:29:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 19:30:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 19:30:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 19:31:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 19:31:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77350689
name: IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder
abuser: 193.228.134.216
country_id: 690791
domain: ibmcglobal.com
description:
IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder||MV:/media/com_acym/images/thumbnails/thumbnail_834.png?.php||SC:/home/ibmcglobal/public_html/media/com_acym||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.46
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-32.62.112.222.46||RSV:8.35||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.209.97.194
country_id: 1880251
description:
[2026-07-25 19:32:40 +0530] info [whostmgrd] 134.209.97.194 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.204.17.66
country_id: 2186224
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/class-config.php||SC:/home/globalgroupoman/public_html/images/class-config.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 19:34:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.13
country_id: 6252001
description:
Jul 25 19:36:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 19:36:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 19:36:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 19:37:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 19:37:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 19:37:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784988598202.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 19:39:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 19:39:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784988553477.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 19:39:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 19:40:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 19:41:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 19:42:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 19:42:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://emergencyacrepair1.info\">https://emergencyacrepair1.info</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.203
country_id: 2017370
description:
Jul 25 19:43:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.203
country_id: 2017370
description:
2026-07-25 19:43:05 dovecot_login authenticator failed for H=(146.47.246.220.static.netvigator.com) [178.178.194.203]:52072: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 19:42:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.85
country_id: 1814991
description:
2026-07-25 19:43:19 dovecot_login authenticator failed for H=([49.124.152.243]) [111.26.63.85]:35084: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 19:43:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 19:43:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 19:43:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.63.85
country_id: 1814991
description:
Jul 25 19:43:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.63.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 19:44:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.110.176.222
country_id: 1694008
description:
Jul 25 19:44:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.110.176.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 19:44:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.9.48
country_id: 1668284
description:
Jul 25 19:45:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.9.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 19:44:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 185.41.248.38
country_id: 690791
domain: www.ahsmarine.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.35||T:APACHE||REQUEST_URI:/wp-content/plugins/dynamic-pricing-discounts/changelog.txt||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-25 19:44:58 dovecot_login authenticator failed for H=(net-62-183-82-70.kbrnet.ru) [27.110.176.222]:47628: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.9.48
country_id: 1668284
description:
2026-07-25 19:45:10 dovecot_login authenticator failed for H=([112.186.203.10]) [101.13.9.48]:42873: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 19:45:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 19:45:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.195.35.240
country_id: 1814991
description:
Jul 25 19:46:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.195.35.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 19:46:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.195.35.240
country_id: 1814991
description:
2026-07-25 19:46:54 dovecot_login authenticator failed for H=(syn-024-142-170-231.biz.spectrum.com) [120.195.35.240]:39622: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 19:46:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 19:46:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 19:47:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.71.146.6
country_id: 2017370
description:
2026-07-25 19:47:16 dovecot_login authenticator failed for H=([103.171.39.147]) [178.71.146.6]:38942: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.71.146.6
country_id: 2017370
description:
Jul 25 19:47:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.71.146.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 19:47:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 19:48:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.41.78
country_id: 2510769
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.144.72.180
country_id: 1814991
description:
2026-07-25 19:49:43 dovecot_login authenticator failed for H=(nsg-static-178.227.75.182-airtel.com) [36.144.72.180]:54220: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.50.190
country_id: 1880251
description:
Jul 25 19:49:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.50.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 19:49:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2026-07-25 19:50:10 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com ([220.94.124.233]) [34.146.248.7]:45726: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 19:49:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 19:49:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.144.72.180
country_id: 1814991
description:
Jul 25 19:49:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.144.72.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.223.27.202
country_id: 2077456
description:
Jul 25 19:50:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.223.27.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.223.27.202
country_id: 2077456
description:
2026-07-25 19:50:48 dovecot_login authenticator failed for H=194-223-27-202.tpgi.com.au ([218.21.37.250]) [194.223.27.202]:50562: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 19:50:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.157.137.112
country_id: 1835841
description:
Jul 25 19:51:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.157.137.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.157.137.112
country_id: 1835841
description:
2026-07-25 19:51:44 dovecot_login authenticator failed for H=([183.104.220.195]) [218.157.137.112]:34416: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 19:52:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 19:52:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://toronto.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 19:52:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 19:53:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: www.yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784989402471.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 19:53:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 19:53:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 25 19:53:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 19:54:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.182.232.150
country_id: 1269750
description:
Jul 25 19:55:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.182.232.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 19:54:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 19:54:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 19:54:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 19:55:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 19:56:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jul 25 19:57:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 19:57:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 19:57:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 19:57:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-25 19:57:16 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 19:59:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 19:58:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 19:58:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 19:59:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 19:59:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.138.254.1
country_id: 2017370
description:
Jul 25 20:00:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.138.254.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.138.254.1
country_id: 2017370
description:
2026-07-25 20:00:05 dovecot_login authenticator failed for H=([98.170.57.236]) [46.138.254.1]:34922: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 20:00:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 20:00:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 20:00:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.38.3.107
country_id: 2215636
description:
Jul 25 20:00:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.38.3.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.107
country_id: 2215636
description:
2026-07-25 20:00:23 dovecot_login authenticator failed for H=([183.6.115.88]) [102.38.3.107]:54615: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 20:01:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 20:01:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 20:01:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2026-07-25 20:02:14 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com ([72.206.74.97]) [34.146.248.7]:52362: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 20:02:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 20:02:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.188.184.13
country_id: 1814991
description:
Jul 25 20:02:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.188.184.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.184.13
country_id: 1814991
description:
2026-07-25 20:02:48 dovecot_login authenticator failed for H=([182.78.112.174]) [27.188.184.13]:56710: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 20:02:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 20:03:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 20:03:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.47.9.240
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:26595.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3b46f85d881c43ef2779431f1695c6613e4fe011||Title:0x7af81a3c||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 20:05:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 20:04:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 20:04:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.27.209
country_id: 1861060
description:
Jul 25 20:04:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.95.27.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.244.208.42
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-07.185.244.208.42||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 20:06:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 20:07:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 20:08:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 20:08:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 20:08:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 20:09:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 20:09:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 20:10:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 20:10:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 20:11:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 20:11:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 20:11:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 20:11:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.109.73.135
country_id: 1835841
description:
Jul 25 20:13:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.109.73.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.109.73.135
country_id: 1835841
description:
2026-07-25 20:13:03 dovecot_login authenticator failed for H=([37.204.111.153]) [222.109.73.135]:54579: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 20:12:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 20:12:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.230.190
country_id: 2661886
description:
2026-07-25 20:13:13 dovecot_login authenticator failed for H=c188-150-230-190.bredband.tele2.se ([117.71.53.210]) [188.150.230.190]:51202: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 20:13:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 20:13:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.230.190
country_id: 2661886
description:
Jul 25 20:13:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.230.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
country_id: 290557
description:
Jul 25 20:14:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-07-25 20:14:44 dovecot_plain authenticator failed for H=(unecting) [5.32.99.14]:53735: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.66.70.156
country_id: 3996063
description:
2026-07-25 20:14:50 dovecot_plain authenticator failed for H=(fecinchyte) [200.66.70.156]:53958: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.42.119.207
country_id: 290291
description:
Jul 25 20:14:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.42.119.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.42.119.207
country_id: 290291
description:
2026-07-25 20:14:53 dovecot_plain authenticator failed for H=(tration) [46.42.119.207]:52716: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.52.179.56
country_id: 2921044
domain: arcrealtors.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/arcrealtorscom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.66.70.156
country_id: 3996063
description:
Jul 25 20:14:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.66.70.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 20:15:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.228.164.236
country_id: 2017370
description:
2026-07-25 20:15:32 dovecot_login authenticator failed for H=(mx-ll-171.5.135-77.dynamic.3bb.co.th) [193.228.164.236]:45184: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.160.72.42
country_id: 1835841
description:
Jul 25 20:15:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.160.72.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.160.72.42
country_id: 1835841
description:
2026-07-25 20:15:47 dovecot_login authenticator failed for H=([149.71.34.141]) [115.160.72.42]:32809: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 20:15:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.228.164.236
country_id: 2017370
description:
Jul 25 20:15:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.228.164.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.13
country_id: 6252001
description:
Jul 25 20:15:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.204.17.66
country_id: 2186224
domain: jaashsupplies.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/class-config.php||SC:/home/jaashsupplies/public_html/images/class-config.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 20:15:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 20:16:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 20:16:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 20:17:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 20:18:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 20:18:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 20:18:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 20:18:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 20:19:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 20:19:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 20:19:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.98.228.218
country_id: 1814991
description:
Jul 25 20:19:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.98.228.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 20:20:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 20:20:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 20:20:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 20:20:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 20:21:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 20:21:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 20:22:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 20:22:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 20:23:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 20:23:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.195.132.165
country_id: 1835841
description:
Jul 25 20:24:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.195.132.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.195.132.165
country_id: 1835841
description:
2026-07-25 20:24:05 dovecot_login authenticator failed for H=([200.164.181.17]) [175.195.132.165]:50002: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.229.237
country_id: 1835841
description:
Jul 25 20:24:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.229.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-25 20:24:22 dovecot_login authenticator failed for H=([107.181.168.150]) [211.105.229.237]:48304: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 20:25:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.223.244.3
country_id: 1269750
description:
Jul 25 20:27:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.223.244.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.244.3
country_id: 1269750
description:
2026-07-25 20:27:02 dovecot_login authenticator failed for H=([174.75.211.203]) [163.223.244.3]:60894: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 20:27:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.61.165
country_id: 895949
description:
Jul 25 20:27:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.61.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.211
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-27.45.135.228.211||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 20:27:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.61.165
country_id: 895949
description:
2026-07-25 20:27:18 dovecot_login authenticator failed for H=([192.252.210.237]) [41.63.61.165]:2098: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 20:27:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 20:28:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77469916
abuser: 182.10.161.108
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcexr7kmra7.xml.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784991512243.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 20:28:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: www.alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784991512492.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 20:28:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 31.220.1.242
country_id: 2921044
domain: www.yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784991512902.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 20:29:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 20:29:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.233.132
country_id: 1269750
description:
Jul 25 20:30:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.233.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 20:30:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 20:31:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 20:31:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 20:31:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 20:31:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.151
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-31.62.112.222.151||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jul 25 20:31:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.51.82
country_id: 1149361
description:
Jul 25 20:31:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.51.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2026-07-25 20:31:57 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [149.54.51.82]:43769: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.39.214
country_id: 1668284
description:
Jul 25 20:32:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.39.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.215.33.197
country_id: 6252001
description:
Jul 25 20:32:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.215.33.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 20:32:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.33.197
country_id: 6252001
description:
2026-07-25 20:32:40 dovecot_login authenticator failed for H=wsip-72-215-33-197.pn.at.cox.net ([77.41.156.64]) [72.215.33.197]:44968: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.214
country_id: 1668284
description:
2026-07-25 20:32:27 dovecot_login authenticator failed for H=111-70-39-214.emome-ip.hinet.net ([59.127.220.67]) [111.70.39.214]:41591: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 20:33:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 20:33:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 20:33:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 20:33:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 20:34:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 20:35:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 20:35:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.141
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-35.51.15.225.141||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 20:35:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 20:37:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 20:37:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 20:36:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 20:36:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.50.190
country_id: 1880251
description:
Jul 25 20:36:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.50.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 20:37:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 20:37:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 20:37:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.160.165.239
country_id: 2017370
description:
Jul 25 20:38:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.160.165.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.160.165.239
country_id: 2017370
description:
2026-07-25 20:38:07 dovecot_login authenticator failed for H=([211.105.229.237]) [46.160.165.239]:52376: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.84.209.188
country_id: 1814991
description:
Jul 25 20:38:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.84.209.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.84.209.188
country_id: 1814991
description:
2026-07-25 20:38:27 dovecot_login authenticator failed for H=([49.125.201.68]) [223.84.209.188]:58526: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 20:39:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-25 20:41:41 dovecot_login authenticator failed for H=([221.159.118.10]) [94.16.17.139]:38882: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 20:41:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.32.197.160
country_id: 130758
description:
Jul 25 20:42:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.32.197.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.32.197.160
country_id: 130758
description:
2026-07-25 20:42:03 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [89.32.197.160]:58101: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 20:42:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 20:42:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 20:42:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 20:42:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 188.163.106.129
country_id: 690791
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:18181.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dec3ec21a8d640aea37aa3cc1412134149e2d447||Title:0x9a97a5cb||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.27.209
country_id: 1861060
description:
Jul 25 20:43:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.95.27.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 20:43:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 20:44:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 20:44:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 20:44:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.19.198.160
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-45.37.19.198.160||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 20:46:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 20:45:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 20:46:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 20:46:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 20:47:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 20:47:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 20:47:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.235.27.139
country_id: 6252001
description:
Jul 25 20:48:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.235.27.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-25 20:48:07 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net ([60.173.105.206]) [71.235.27.139]:60196: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 20:48:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 20:47:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 20:48:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.250.9.98
country_id: 2017370
description:
Jul 25 20:48:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.250.9.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.250.9.98
country_id: 2017370
description:
2026-07-25 20:48:33 dovecot_login authenticator failed for H=host87-250-9-098.etth.mark-itt.net ([218.92.251.198]) [87.250.9.98]:58944: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 20:49:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 20:49:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 20:49:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 20:49:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 20:50:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 20:50:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 20:51:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.206.131.33
country_id: 1269750
description:
Jul 25 20:51:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.206.131.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 20:50:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-25 20:51:10 dovecot_login authenticator failed for H=([111.53.189.3]) [103.206.131.33]:41540: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.29.219.54
country_id: 1835841
description:
Jul 25 20:51:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.29.219.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.29.219.54
country_id: 1835841
description:
2026-07-25 20:51:32 dovecot_login authenticator failed for H=(abts-mp-static-245.197.168.122.airtelbroadband.in) [59.29.219.54]:50652: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.62.73.218
country_id: 1835841
description:
Jul 25 20:52:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.62.73.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.62.73.218
country_id: 1835841
description:
2026-07-25 20:52:47 dovecot_login authenticator failed for H=([144.24.209.174]) [211.62.73.218]:54246: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 20:52:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.15.224.102
country_id: 1814991
description:
2026-07-25 20:53:08 dovecot_login authenticator failed for H=([50.231.243.28]) [218.15.224.102]:49597: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.15.224.102
country_id: 1814991
description:
Jul 25 20:53:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.15.224.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 20:53:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 20:53:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.228.242
country_id: 1036973
description:
Jul 25 20:53:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.228.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-25 20:53:28 dovecot_login authenticator failed for H=([104.37.135.150]) [197.219.228.242]:58924: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.123
country_id: 2017370
description:
Jul 25 20:53:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.123
country_id: 2017370
description:
2026-07-25 20:53:39 dovecot_login authenticator failed for H=([142.54.239.4]) [178.178.194.123]:50074: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 20:53:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-25 20:54:39 dovecot_login authenticator failed for H=(220-240-104-100.tpgi.com.au) [38.108.83.2]:22226: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 20:54:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 20:54:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 20:54:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 20:54:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.108.83.2
country_id: 6251999
description:
Jul 25 20:54:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.108.83.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 20:55:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.13
country_id: 6252001
description:
Jul 25 20:55:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.209.50
country_id: 1835841
description:
2026-07-25 20:55:24 dovecot_login authenticator failed for H=([223.167.75.86]) [182.31.209.50]:42465: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.31.209.50
country_id: 1835841
description:
Jul 25 20:55:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.31.209.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 20:56:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 20:57:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 20:57:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 21:00:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.41
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-00.91.243.81.41||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 21:01:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 21:01:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 21:02:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 21:02:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.29.38.71
country_id: 2017370
description:
2026-07-25 21:02:50 dovecot_login authenticator failed for H=94-29-38-71.dynamic.spd-mgts.ru (ip-68-71-242-113.hosts.zerolag.com) [94.29.38.71]:55243: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.90.248.108
country_id: 1814991
description:
Jul 25 21:03:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.90.248.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.29.38.71
country_id: 2017370
description:
Jul 25 21:02:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.29.38.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 21:02:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 21:02:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.90.248.108
country_id: 1814991
description:
2026-07-25 21:03:10 dovecot_login authenticator failed for H=([106.0.166.123]) [182.90.248.108]:29234: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.119.74.228
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ahsmarine/public_html/wp-content/uploads/admin.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.116.141.82
country_id: 1814991
description:
Jul 25 21:03:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.116.141.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 21:03:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.186.46
country_id: 6252001
description:
Jul 25 21:03:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.186.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.141.82
country_id: 1814991
description:
2026-07-25 21:03:41 dovecot_login authenticator failed for H=(111-70-23-254.emome-ip.hinet.net) [123.116.141.82]:60535: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 21:04:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.141
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-05.51.15.225.141||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 21:05:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 21:05:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 21:06:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2026-07-25 21:07:06 dovecot_login authenticator failed for H=([109.233.21.109]) [186.239.41.74]:46010: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 21:06:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 21:06:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.7.254
country_id: 1668284
description:
2026-07-25 21:06:52 dovecot_login authenticator failed for H=111-70-7-254.emome-ip.hinet.net ([195.222.57.183]) [111.70.7.254]:36370: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 21:06:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Jul 25 21:07:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 21:06:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jul 25 21:06:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.7.254
country_id: 1668284
description:
Jul 25 21:06:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.7.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 21:06:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.235.106
country_id: 1835841
description:
Jul 25 21:06:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.235.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.235.106
country_id: 1835841
description:
2026-07-25 21:06:52 dovecot_login authenticator failed for H=([115.241.228.34]) [125.143.235.106]:60808: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 21:07:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 21:07:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 21:07:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 21:07:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 21:07:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-25 21:07:19 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [94.16.17.139]:33922: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
country_id: 1668284
description:
2026-07-25 21:08:11 dovecot_login authenticator failed for H=111-70-32-5.emome-ip.hinet.net ([186.238.52.128]) [111.70.32.5]:47170: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 21:08:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.56.179.201
country_id: 1814991
description:
Jul 25 21:08:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.56.179.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.56.179.201
country_id: 1814991
description:
2026-07-25 21:08:29 dovecot_login authenticator failed for H=([49.124.151.69]) [183.56.179.201]:57348: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.76.221.51
country_id: 1835841
description:
Jul 25 21:08:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.76.221.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.76.221.51
country_id: 1835841
description:
2026-07-25 21:08:44 dovecot_login authenticator failed for H=(110-25-112-132.adsl.fetnet.net) [61.76.221.51]:2566: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.190.152
country_id: 3469034
description:
Jul 25 21:08:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.190.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.74.85.184
country_id: 1880251
description:
Jul 25 21:08:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.74.85.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 21:08:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.5
country_id: 1668284
description:
Jul 25 21:08:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.190.152
country_id: 3469034
description:
2026-07-25 21:08:57 dovecot_login authenticator failed for H=(syn-137-027-032-070.biz.spectrum.com) [131.0.190.152]:44951: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 21:09:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 21:10:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 21:10:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 21:10:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.149.131
country_id: 1269750
description:
Jul 25 21:11:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.149.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 21:12:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 21:13:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 21:12:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.230.76
country_id: 1814991
description:
Jul 25 21:13:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.230.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-25 21:14:01 dovecot_login authenticator failed for H=(mx-ll-180.183.245-232.dynamic.3bb.in.th) [182.95.119.30]:51570: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.230.76
country_id: 1814991
description:
2026-07-25 21:13:47 dovecot_login authenticator failed for H=(ip-178-46-128-225.dsl.surnet.ru) [218.25.230.76]:34102: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 21:13:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.119.30
country_id: 1269750
description:
Jul 25 21:13:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.119.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 21:14:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 21:14:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 21:14:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 51.116.233.22
country_id: 2921044
domain: metrodigitals.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/metrodigitals/public_html/wp-includes||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.33.44
country_id: 2017370
description:
Jul 25 21:14:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.33.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 21:14:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.120.42.31
country_id: 1733045
description:
2026-07-25 21:16:39 dovecot_login authenticator failed for H=([1.227.135.190]) [121.120.42.31]:50470: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 21:16:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.187.230.168
country_id: 298795
description:
Jul 25 21:16:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.187.230.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-25 21:16:53 dovecot_login authenticator failed for H=([174.75.211.204]) [78.187.230.168]:49577: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 21:17:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 21:18:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 21:18:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.199.84.185
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-18.91.199.84.185||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 21:18:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 21:20:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.181.138
country_id: 1269750
description:
Jul 25 21:20:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.181.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-25 21:20:54 dovecot_login authenticator failed for H=(ticons.static.gvt.net.br) [182.95.181.138]:33388: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 87.121.33.27
country_id: 2077456
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-20.87.121.33.27||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 21:20:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.161.20
country_id: 6252001
description:
Jul 25 21:21:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.161.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.63.248
country_id: 6252001
description:
[2026-07-25 21:21:15 +0530] info [whostmgrd] 146.190.63.248 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 21:22:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 21:22:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 21:22:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 21:23:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.10.21
country_id: 1562822
description:
Jul 25 21:23:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.158.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.50.190
country_id: 1880251
description:
Jul 25 21:23:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.50.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 21:24:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 21:24:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 21:25:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 21:25:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 21:25:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 21:25:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-25 21:26:27 dovecot_login authenticator failed for H=([49.124.149.53]) [197.242.170.10]:64488: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.161.126
country_id: 1562822
description:
Jul 25 21:26:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.161.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.245.184.230
country_id: 2017370
description:
Jul 25 21:26:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.245.184.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.245.184.230
country_id: 2017370
description:
2026-07-25 21:26:40 dovecot_login authenticator failed for H=([62.182.132.94]) [185.245.184.230]:54840: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 21:26:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 21:26:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 21:27:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 21:27:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.163.185
country_id: 6252001
description:
Jul 25 21:27:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.163.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 21:28:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 21:28:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.245.96
country_id: 1643084
description:
Jul 25 21:28:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.253.245.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.93.197
country_id: 1814991
description:
Jul 25 21:29:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.93.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.93.197
country_id: 1814991
description:
2026-07-25 21:29:18 dovecot_login authenticator failed for H=([49.124.133.224]) [117.159.93.197]:50777: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 21:29:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.20.61
country_id: 1835841
description:
Jul 25 21:29:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.20.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-07-25 21:29:47 dovecot_login authenticator failed for H=([163.223.244.3]) [128.185.12.179]:47384: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.129
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-30.91.243.81.129||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.159.50.104
country_id: 1562822
description:
Jul 25 21:30:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.159.50.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 130758
description:
Jul 25 21:30:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 21:31:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.18.158.119
country_id: 1210997
description:
Jul 25 21:31:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.18.158.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 21:32:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 21:32:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 21:33:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.67
country_id: 130758
description:
Jul 25 21:33:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.131.58.26
country_id: 2921044
description:
Jul 25 21:33:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.131.58.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.179
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-34.45.135.228.179||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 21:33:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.14.47.121
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-33.185.14.47.121||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 21:34:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 21:34:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.191.58.34
country_id: 1562822
description:
Jul 25 21:34:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.191.58.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.159.179.93
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-34.51.159.179.93||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 21:34:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.13
country_id: 6252001
description:
Jul 25 21:36:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.49
country_id: 130758
description:
Jul 25 21:36:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.207.14
country_id: 1562822
description:
Jul 25 21:36:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.207.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.52.54.143
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/cochinbigbandsho/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 21:37:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 21:39:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.50
country_id: 130758
description:
Jul 25 21:40:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.177
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-39.62.112.222.177||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.239.91
country_id: 2921044
description:
Jul 25 21:39:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.239.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.201.25.69
country_id: 2921044
description:
Jul 25 21:39:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.201.25.69 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.39.70.85
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-39.89.39.70.85||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 21:41:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.66.80.124
country_id: 1562822
description:
Jul 25 21:41:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.66.80.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.75.185.141
country_id: 1562822
description:
Jul 25 21:42:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.75.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.18
country_id: 130758
description:
Jul 25 21:43:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.220.144
country_id: 1562822
description:
Jul 25 21:43:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.220.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.18.204
country_id: 3017382
description:
Jul 25 21:43:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.18.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.13
country_id: 130758
description:
Jul 25 21:43:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 21:43:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 21:43:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 21:44:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.137.185
country_id: 2017370
description:
2026-07-25 21:45:55 dovecot_login authenticator failed for H=broadband-95-84-137-185.ip.moscow.rt.ru ([20.224.41.181]) [95.84.137.185]:56866: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.137.185
country_id: 2017370
description:
Jul 25 21:45:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.137.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://www.ttv-burgstaedt.de/gaestebuch?1360\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.62.73.218
country_id: 1835841
description:
Jul 25 21:46:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.62.73.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.62.73.218
country_id: 1835841
description:
2026-07-25 21:46:10 dovecot_login authenticator failed for H=([142.54.231.33]) [211.62.73.218]:53666: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 195.178.110.211
country_id: 732800
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Bad file extension||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/debug.log||User:vrishenterprises||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 21:53:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-25 21:53:53 dovecot_login authenticator failed for H=([192.252.208.66]) [185.15.82.135]:50485: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.51.12.142
country_id: 1835841
description:
Jul 25 21:53:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.51.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-25 21:53:18 dovecot_login authenticator failed for H=([116.113.241.82]) [14.51.12.142]:56302: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
country_id: 1814991
description:
Jul 25 21:54:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
country_id: 1814991
description:
2026-07-25 21:54:12 dovecot_login authenticator failed for H=([125.20.230.46]) [182.139.39.150]:39994: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 21:55:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 21:57:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-25 21:58:06 dovecot_login authenticator failed for H=(111-70-29-130.emome-ip.hinet.net) [125.23.228.86]:53186: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.212.91.18
country_id: 1814991
description:
Jul 25 21:57:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.212.91.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.212.91.18
country_id: 1814991
description:
2026-07-25 21:57:50 dovecot_login authenticator failed for H=([125.88.160.13]) [222.212.91.18]:57080: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.228.86
country_id: 1269750
description:
Jul 25 21:58:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.228.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-07-25 21:58:43 dovecot_login authenticator failed for H=([89.32.197.160]) [1.241.64.237]:44422: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.73.22
country_id: 1835841
description:
2026-07-25 21:58:49 dovecot_login authenticator failed for H=(activox.static.gvt.net.br) [58.65.73.22]:46051: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.223
country_id: 1733045
description:
2026-07-25 21:58:26 dovecot_login authenticator failed for H=([101.13.5.49]) [49.124.152.223]:37188: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.99.79.157
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:21-59.194.99.79.157||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.82.56.12
country_id: 1269750
description:
Jul 25 21:59:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.82.56.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-25 21:59:13 dovecot_login authenticator failed for H=([49.125.201.68]) [183.82.56.12]:52505: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.38.136.211
country_id: 1814991
description:
2026-07-25 22:00:28 dovecot_login authenticator failed for H=(net-188-219-104-210.cust.vodafonedsl.it) [111.38.136.211]:41920: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.38.136.211
country_id: 1814991
description:
Jul 25 22:00:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.38.136.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.8.226.227
country_id: 2017370
description:
Jul 25 22:00:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.8.226.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.8.226.227
country_id: 2017370
description:
2026-07-25 22:00:41 dovecot_login authenticator failed for H=(217.42.246.220.static.netvigator.com) [217.8.226.227]:59645: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.159.179.93
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-02.51.159.179.93||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 22:01:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.9.247.58
country_id: 3469034
description:
Jul 25 22:03:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.9.247.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-07-25 22:03:43 dovecot_login authenticator failed for H=(136-34-252-154.googlefiber.net) [187.9.247.58]:42744: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.167.120
country_id: 1814991
description:
Jul 25 22:03:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.167.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.167.120
country_id: 1814991
description:
2026-07-25 22:04:00 dovecot_login authenticator failed for H=([213.235.25.2]) [112.31.167.120]:36378: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.245
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-04.149.34.251.245||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.151.142.106
country_id: 1814991
description:
Jul 25 22:06:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.151.142.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 22:07:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.222.124.164
country_id: 1814991
description:
Jul 25 22:08:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.222.124.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.149.15.47
country_id: 1814991
description:
2026-07-25 22:09:06 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [61.149.15.47]:50210: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.222.124.164
country_id: 1814991
description:
2026-07-25 22:08:47 dovecot_login authenticator failed for H=(broadband-109-173-39-103.ip.moscow.rt.ru) [222.222.124.164]:53510: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.149.15.47
country_id: 1814991
description:
Jul 25 22:09:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.149.15.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.131.5
country_id: 2077456
description:
Jul 25 22:08:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.131.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.131.5
country_id: 2077456
description:
2026-07-25 22:08:30 dovecot_login authenticator failed for H=182-239-131-5.tpgi.com.au ([213.230.64.246]) [182.239.131.5]:33641: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.28.215
country_id: 1269750
description:
Jul 25 22:09:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.28.215 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.39.70.233
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-09.89.39.70.233||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.115.219.90
country_id: 1814991
description:
2026-07-25 22:09:40 dovecot_login authenticator failed for H=([46.163.174.216]) [49.115.219.90]:37908: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.115.219.90
country_id: 1814991
description:
Jul 25 22:09:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.115.219.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.28.215
country_id: 1269750
description:
2026-07-25 22:09:52 dovecot_login authenticator failed for H=([49.124.149.50]) [49.206.28.215]:42666: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.238.103.64
country_id: 1819730
description:
Jul 25 22:11:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.238.103.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.1
country_id: 6252001
description:
Jul 25 22:12:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.141
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-13.51.15.225.141||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:15:35 dovecot_login authenticator failed for H=(fdofEUOTl) [64.89.161.12]:59720: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.14.47.209
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-15.185.14.47.209||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 93.152.205.216
country_id: 732800
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:703703.pht||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.12
country_id: 6252001
description:
Jul 25 22:15:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.12
country_id: 6252001
description:
Jul 25 22:16:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:16:11 dovecot_login authenticator failed for H=(6qcbEOui) [64.89.161.12]:53326: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.89.161.12
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[64.89.161.12] [Authentication Database]=[mail] [Username]=[jijo@ddgalaxy.in] (5/5 failures) (blocked until [Sat Jul 25 17:01:27 2026 UTC/Sat Jul 25 22:31:27 2026 LOCAL])


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.67.8.205
country_id: 1269750
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-18.152.67.8.205||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:17:26 dovecot_login authenticator failed for H=(hekWYZ6yw) [64.89.161.12]:62219: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.114.35.15
country_id: 1814991
description:
2026-07-25 22:18:06 dovecot_login authenticator failed for H=([174.64.199.85]) [122.114.35.15]:40460: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:18:20 dovecot_login authenticator failed for H=(QJ0eAw5L5) [64.89.161.12]:55465: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.60.9.114
country_id: 1814991
description:
2026-07-25 22:18:26 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [119.60.9.114]:51675: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:18:38 dovecot_login authenticator failed for H=(KKg0vx) [64.89.161.12]:56162: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 22:18:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-25 22:19:25 dovecot_login authenticator failed for H=([118.40.157.149]) [85.105.255.56]:48389: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:19:14 dovecot_login authenticator failed for H=(EdSH4UCO) [64.89.161.12]:54377: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2026-07-25 22:19:15 dovecot_login authenticator failed for H=([65.20.179.251]) [212.135.208.13]:46337: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.135.208.13
country_id: 1861060
description:
Jul 25 22:19:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.135.208.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.255.56
country_id: 298795
description:
Jul 25 22:19:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.255.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.195.41
country_id: 1814991
description:
Jul 25 22:21:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.195.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.195.41
country_id: 1814991
description:
2026-07-25 22:21:09 dovecot_login authenticator failed for H=([70.166.167.44]) [120.234.195.41]:59751: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:20:28 dovecot_login authenticator failed for H=(uAkxxw) [64.89.161.12]:58308: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.198.161.85
country_id: 1814991
description:
2026-07-25 22:22:06 dovecot_login authenticator failed for H=([47.215.0.179]) [223.198.161.85]:35369: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:21:11 dovecot_login authenticator failed for H=(EGK9ka8K) [64.89.161.12]:56735: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:22:16 dovecot_login authenticator failed for H=(bqRhSzo) [64.89.161.12]:57859: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.34.145.77
country_id: 1814991
description:
Jul 25 22:22:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.34.145.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.34.145.77
country_id: 1814991
description:
2026-07-25 22:22:20 dovecot_login authenticator failed for H=(wgpon-39181-194.wateen.net) [171.34.145.77]:42378: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:22:34 dovecot_login authenticator failed for H=(7zly2VSzsU) [64.89.161.12]:56206: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:23:10 dovecot_login authenticator failed for H=(XmpLXqsFv3) [64.89.161.12]:53747: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.89.161.12
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[64.89.161.12] [Authentication Database]=[mail] [Username]=[jijo@ddgalaxy.in] (30/30 failures) (blocked until [Sun Jul 26 16:54:02 2026 UTC/Sun Jul 26 22:24:02 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-25 22:24:49 dovecot_login authenticator failed for H=([70.166.167.49]) [207.254.29.22]:56721: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-25 22:25:00 dovecot_login authenticator failed for H=(nsg-static-201.69.75.182-airtel.com) [41.128.181.196]:40714: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 22:25:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.254.29.22
country_id: 2963597
description:
Jul 25 22:24:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.254.29.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.128.181.196
country_id: 357994
description:
Jul 25 22:24:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.128.181.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.89.161.12
country_id: 6252001
description:
2026-07-25 22:24:22 dovecot_login authenticator failed for H=(9tqf0natDG) [64.89.161.12]:57647: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


