# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 17:45:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.23
country_id: 953987
description:
May 12 17:49:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 17:50:13 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.223.84.46
country_id: 6252001
description:
[2026-05-12 17:50:35 +0200] info [whostmgrd] 13.223.84.46 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 13.223.84.46
country_id: 6252001
description:
[2026-05-12 17:50:36 +0200] info [whostmgrd] 13.223.84.46 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.188.202
country_id: 3469034
description:
May 12 17:50:38 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.93.10.9
country_id: 6252001
description:
[2026-05-12 17:54:01 +0200] info [whostmgrd] 35.93.10.9 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 35.93.10.9
country_id: 6252001
description:
[2026-05-12 17:54:02 +0200] info [whostmgrd] 35.93.10.9 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 18.144.71.128
country_id: 6252001
description:
[2026-05-12 17:58:47 +0200] info [whostmgrd] 18.144.71.128 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.144.71.128
country_id: 6252001
description:
[2026-05-12 17:58:45 +0200] info [whostmgrd] 18.144.71.128 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 12 18:00:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.57.15.117
country_id: 6252001
description:
[2026-05-12 18:02:03 +0200] info [whostmgrd] 13.57.15.117 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 13.57.15.117
country_id: 6252001
description:
[2026-05-12 18:02:05 +0200] info [whostmgrd] 13.57.15.117 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.144.40.151
country_id: 6252001
description:
[2026-05-12 18:09:37 +0200] info [whostmgrd] 18.144.40.151 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 18.144.40.151
country_id: 6252001
description:
[2026-05-12 18:09:39 +0200] info [whostmgrd] 18.144.40.151 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 18:10:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 54.176.86.105
country_id: 6252001
description:
[2026-05-12 18:11:42 +0200] info [whostmgrd] 54.176.86.105 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.176.86.105
country_id: 6252001
description:
[2026-05-12 18:11:41 +0200] info [whostmgrd] 54.176.86.105 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 18:12:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.208.176.206
country_id: 1861060
description:
[2026-05-12 18:13:07 +0200] info [whostmgrd] 13.208.176.206 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 13.208.176.206
country_id: 1861060
description:
[2026-05-12 18:13:08 +0200] info [whostmgrd] 13.208.176.206 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 56.125.131.226
country_id: 3469034
description:
[2026-05-12 18:13:11 +0200] info [whostmgrd] 56.125.131.226 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.88.22.108
country_id: 6252001
description:
[2026-05-12 18:19:18 +0200] info [whostmgrd] 35.88.22.108 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 35.88.22.108
country_id: 6252001
description:
[2026-05-12 18:19:19 +0200] info [whostmgrd] 35.88.22.108 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.176.165.129
country_id: 6252001
description:
[2026-05-12 18:22:53 +0200] info [whostmgrd] 54.176.165.129 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 54.176.165.129
country_id: 6252001
description:
[2026-05-12 18:22:54 +0200] info [whostmgrd] 54.176.165.129 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 18:31:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.62.97
country_id: 1814991
description:
May 12 18:31:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.62.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.97
country_id: 1814991
description:
2026-05-12 18:31:44 dovecot_login authenticator failed for H=([49.124.153.51]) [36.135.62.97]:52548: 535 Incorrect authentication data (set_id=upport@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 18:39:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.144.101.100
country_id: 6252001
description:
[2026-05-12 18:49:13 +0200] info [whostmgrd] 3.144.101.100 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 3.144.101.100
country_id: 6252001
description:
[2026-05-12 18:49:15 +0200] info [whostmgrd] 3.144.101.100 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 18:52:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 19:06:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.254
country_id: 1814991
description:
2026-05-12 19:11:38 dovecot_login authenticator failed for H=([203.147.89.38]) [111.26.95.254]:54226: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.212.0.13
country_id: 1814991
description:
May 12 19:11:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.212.0.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.212.0.13
country_id: 1814991
description:
2026-05-12 19:11:32 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [60.212.0.13]:45873: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.95.254
country_id: 1814991
description:
May 12 19:11:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.95.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.53.58.10
country_id: 1835841
description:
May 12 19:12:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.53.58.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
country_id: 1835841
description:
2026-05-12 19:12:25 dovecot_login authenticator failed for H=([5.26.117.181]) [211.53.58.10]:57880: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 19:34:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 19:35:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.133
country_id: 3175395
description:
May 12 19:46:37 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.208.122
country_id: 933860
description:
May 12 19:46:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.208.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.28
country_id: 3469034
description:
May 12 19:47:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.157.134
country_id: 690791
description:
May 12 19:47:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.157.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 19:59:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 20:04:10 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.137.3
country_id: 1814991
description:
May 12 20:11:09 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.137.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.137.3
country_id: 1814991
description:
2026-05-12 20:11:11 dovecot_login authenticator failed for H=(pool.luganet.ru) [221.2.137.3]:56580: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.46.80.154
country_id: 1814991
description:
May 12 20:10:54 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.46.80.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.46.80.154
country_id: 1814991
description:
2026-05-12 20:10:56 dovecot_login authenticator failed for H=([192.111.130.1]) [112.46.80.154]:47142: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 20:26:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 20:32:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 20:32:47 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.249.134.39
country_id: 6252001
description:
May 12 20:47:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.249.134.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.249.134.39
country_id: 6252001
description:
2026-05-12 20:47:59 dovecot_plain authenticator failed for H=([10.141.173.99]) [87.249.134.39]:61619: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 20:52:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 20:57:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 21:01:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.234
country_id: 226074
description:
May 12 21:45:15 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.234
country_id: 226074
description:
May 12 21:45:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.206.245.133
country_id: 798544
description:
May 12 21:46:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.206.245.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.206.245.133
country_id: 798544
description:
May 12 21:46:24 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.206.245.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.171.61.137
country_id: 1733045
description:
May 12 23:03:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.171.61.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.61.137
country_id: 1733045
description:
2026-05-12 23:03:47 dovecot_login authenticator failed for H=([199.58.185.11]) [183.171.61.137]:35346: 535 Incorrect authentication data (set_id=upport@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.146.167
country_id: 99237
description:
May 12 23:41:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.249.97.118
country_id: 3469034
description:
May 12 23:41:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.249.97.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.24.34.253
country_id: 6290252
description:
May 12 23:42:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.24.34.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.104
country_id: 3469034
description:
May 12 23:43:08 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.104
country_id: 3469034
description:
May 12 23:43:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.241
country_id: 690791
description:
2026-05-13 00:29:04 H=([77.83.39.241]) [77.83.39.241]:61786 F=<dpr@priv8shop.com> rejected RCPT <panpeter550@rocketmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.126
country_id: 3175395
description:
May 13 00:33:04 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 01:27:18 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.136
country_id: 130758
description:
May 13 01:29:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 13 01:29:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 13 01:29:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 01:30:52 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 13 01:37:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.136
country_id: 130758
description:
May 13 01:41:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 13 01:41:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 01:42:38 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 13 01:43:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 01:44:16 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 13 01:52:56 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 13 01:52:56 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.136
country_id: 130758
description:
May 13 01:52:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 01:54:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 13 01:56:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 13 01:59:18 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 02:01:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.203
country_id: 2510769
description:
May 13 02:01:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.227
country_id: 690791
description:
May 13 02:02:02 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.211.247.155
country_id: 1733045
description:
[2026-05-13 02:03:28 +0200] info [whostmgrd] 85.211.247.155 - root "GET /cpsess2155900556/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.211.247.155
country_id: 1733045
description:
[2026-05-13 02:03:28 +0200] info [whostmgrd] 85.211.247.155 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 13 02:04:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.136
country_id: 130758
description:
May 13 02:04:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 02:06:09 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 13 02:07:54 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.211.247.155
country_id: 1733045
description:
[2026-05-13 02:10:00 +0200] info [whostmgrd] 85.211.247.155 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.211.247.155
country_id: 1733045
description:
[2026-05-13 02:10:00 +0200] info [whostmgrd] 85.211.247.155 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 13 02:10:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 13 02:16:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.136
country_id: 130758
description:
May 13 02:16:12 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 02:17:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 02:18:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 13 02:20:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 13 02:22:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 13 02:24:09 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 13 02:27:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.136
country_id: 130758
description:
May 13 02:27:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 02:29:41 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 02:35:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 13 02:37:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 13 02:37:56 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 13 02:39:14 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.136
country_id: 130758
description:
May 13 02:39:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 13 02:41:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 02:41:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.136
country_id: 130758
description:
May 13 02:51:07 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 13 02:52:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 02:52:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 13 03:01:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.136
country_id: 130758
description:
May 13 03:02:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 03:09:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.136
country_id: 130758
description:
May 13 03:14:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 13 03:22:58 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 03:26:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 13 03:29:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 03:43:41 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 13 03:43:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 04:00:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 13 04:04:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.132.94
country_id: 2017370
description:
May 13 04:07:53 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.132.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.132.94
country_id: 2017370
description:
2026-05-13 04:07:55 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [62.182.132.94]:58538: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 04:17:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 13 04:25:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 04:31:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 04:34:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 157.245.196.165
country_id: 1880251
description:
[2026-05-13 04:36:23 +0200] info [whostmgrd] 157.245.196.165 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.245.196.165
country_id: 1880251
description:
[2026-05-13 04:36:23 +0200] info [whostmgrd] 157.245.196.165 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 04:38:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.111.152.246
country_id: 3469034
description:
May 13 04:42:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.111.152.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.1
country_id: 3469034
description:
May 13 04:42:41 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.111.152.246
country_id: 3469034
description:
May 13 04:42:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.111.152.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 04:45:19 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 13 04:46:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.129.249.39
country_id: 1819730
description:
May 13 04:51:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.129.249.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.176.82.156
country_id: 1880251
description:
May 13 04:58:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.176.82.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 04:58:53 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 05:06:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 13 05:07:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.241
country_id: 953987
description:
May 13 05:09:08 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.113.113.130
country_id: 1269750
description:
May 13 05:09:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.113.113.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 05:15:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.127.32.106
country_id: 1269750
description:
May 13 05:19:06 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.127.32.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.127.32.106
country_id: 1269750
description:
2026-05-13 05:19:08 dovecot_login authenticator failed for H=([36.137.38.119]) [103.127.32.106]:46485: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 05:26:04 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 05:27:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 13 05:28:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 05:34:38 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 05:39:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 05:39:53 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 05:51:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 05:53:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 06:03:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 06:06:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 06:07:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 06:15:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.194.31
country_id: 3469034
description:
May 13 06:15:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.194.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.42
country_id: 2300660
description:
May 13 06:16:00 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 06:21:52 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 06:27:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 06:36:24 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 06:39:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 06:50:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 06:51:06 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 07:03:01 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 07:04:41 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 192.253.248.136
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[156.67.111.41] [Local Port]=[993] [Remote IP Address]=[192.253.248.136] [Remote Port]=[58024] [Authentication Database]=[mail] [Username]=[support@easytravelsworld.com] (30/30 failures) (blocked until [Thu May 14 05:09:57 2026 UTC/Thu May 14 07:09:57 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 172.94.9.205
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[156.67.111.41] [Local Port]=[993] [Remote IP Address]=[172.94.9.205] [Remote Port]=[44208] [Authentication Database]=[mail] [Username]=[no-reply@dronomaticaviation.com] (30/30 failures) (blocked until [Thu May 14 05:14:57 2026 UTC/Thu May 14 07:14:57 2026 LOCAL])


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.205
country_id: 130758
description:
May 13 07:14:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.60.247.90
country_id: 1168579
description:
May 13 07:18:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.60.247.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.60.247.90
country_id: 1168579
description:
2026-05-13 07:18:30 dovecot_plain authenticator failed for H=(UJZECE2W) [39.60.247.90]:53684: 535 Incorrect authentication data (set_id=contact@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.60.247.90
country_id: 1168579
description:
May 13 07:18:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.60.247.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.60.247.90
country_id: 1168579
description:
2026-05-13 07:18:36 dovecot_login authenticator failed for H=(UJZECE2W) [39.60.247.90]:53684: 535 Incorrect authentication data (set_id=contact@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 07:18:52 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 07:29:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 07:32:58 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.99.18
country_id: 1269750
description:
May 13 07:49:38 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.99.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.99.18
country_id: 1269750
description:
2026-05-13 07:49:40 dovecot_login authenticator failed for H=([211.116.107.222]) [117.198.99.18]:33361: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 08:01:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 08:16:19 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 08:30:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 08:44:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.144.72.180
country_id: 1814991
description:
May 13 08:51:52 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.144.72.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.144.72.180
country_id: 1814991
description:
2026-05-13 08:51:54 dovecot_login authenticator failed for H=([187.8.17.38]) [36.144.72.180]:55592: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.110.186
country_id: 1269750
description:
May 13 08:51:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.110.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.110.186
country_id: 1269750
description:
2026-05-13 08:51:57 dovecot_plain authenticator failed for H=(votish) [182.95.110.186]:33780: 535 Incorrect authentication data (set_id=career@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 08:58:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.206.217
country_id: 1269750
description:
[2026-05-13 09:01:29 +0200] info [webmaild] 106.222.206.217 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.206.217
country_id: 1269750
description:
[2026-05-13 09:01:39 +0200] info [webmaild] 106.222.206.217 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.248
country_id: 3469034
description:
May 13 09:02:14 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.105.5
country_id: 798544
description:
May 13 09:03:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.105.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.248.174
country_id: 3469034
description:
May 13 09:02:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.248.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.92.209.141
country_id: 614540
description:
May 13 09:03:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.92.209.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.105.5
country_id: 798544
description:
May 13 09:03:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.105.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.206.217
country_id: 1269750
description:
[2026-05-13 09:04:50 +0200] info [webmaild] 106.222.206.217 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.29.57
country_id: 2017370
description:
2026-05-13 09:09:31 dovecot_login authenticator failed for H=(red.179.63.55.122.fastfiber.com.ar) [109.195.29.57]:56754: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.29.57
country_id: 2017370
description:
May 13 09:09:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.29.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.98
country_id: 6252001
description:
May 13 09:09:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-05-13 09:09:48 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com ([182.135.63.175]) [35.130.111.98]:45293: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 09:13:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.51
country_id: 294640
description:
May 13 09:19:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2026-05-13 09:19:29 dovecot_login authenticator failed for H=([210.56.12.205]) [2.55.88.51]:44710: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 09:27:26 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 09:32:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
country_id: 99237
description:
May 13 09:34:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-05-13 09:34:38 dovecot_plain authenticator failed for H=(subgess) [65.20.205.197]:40966: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 09:41:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.107
country_id: 2215636
description:
2026-05-13 09:43:05 dovecot_login authenticator failed for H=([142.54.235.12]) [102.38.3.107]:60958: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.38.3.107
country_id: 2215636
description:
May 13 09:43:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.38.3.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.135.117.245
country_id: 6252001
description:
May 13 09:43:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.135.117.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-05-13 09:43:48 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net ([49.125.201.66]) [107.135.117.245]:31243: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 09:55:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 13 09:59:53 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 10:10:15 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.179.90.53
country_id: 1269750
description:
[2026-05-13 10:13:04 +0200] info [webmaild] 122.179.90.53 - amruttbhatt@bechomaxx.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.0.26
country_id: 2017370
description:
May 13 10:18:41 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.0.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.26
country_id: 2017370
description:
2026-05-13 10:18:43 dovecot_login authenticator failed for H=([49.124.153.14]) [31.173.0.26]:50134: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 10:24:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 10:38:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 10:52:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.163
country_id: 3469034
description:
May 13 10:57:13 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.154.44
country_id: 690791
description:
May 13 10:58:07 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.154.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 11:06:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 13 11:09:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.210.65
country_id: 1269750
description:
[2026-05-13 11:14:17 +0200] info [webmaild] 106.222.210.65 - amruttbhatt@bechomaxx.com "POST /cpsess8428405734/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [106.222.207.128] != Current IP Address [106.222.210.65]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 11:20:37 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 11:23:47 india kernel: php-fpm[2181908]: segfault at 7f3a1c4a4d1e ip 00007f3a28b37777 sp 00007fffc0f80278 error 4 in opcache.so[7f3a28b00000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 11:34:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.14.161
country_id: 2017370
description:
2026-05-13 11:58:23 dovecot_plain authenticator failed for H=(antomollic) [109.195.14.161]:54161: 535 Incorrect authentication data (set_id=career@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.14.161
country_id: 2017370
description:
May 13 11:58:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.14.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 20.123.43.104
country_id: 2963597
description:
[2026-05-13 12:26:47 +0200] info [whostmgrd] 20.123.43.104 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 20.123.43.104
country_id: 2963597
description:
[2026-05-13 12:26:48 +0200] info [whostmgrd] 20.123.43.104 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.138.74
country_id: 1269750
description:
May 13 12:47:08 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.138.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-05-13 12:47:10 dovecot_login authenticator failed for H=(dhcp-72-234-16-75.hawaiiantel.net) [125.19.138.74]:58266: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.209.248.83
country_id: 798544
description:
May 13 12:54:08 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.209.248.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.160
country_id: 690791
description:
May 13 12:54:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.160
country_id: 690791
description:
May 13 12:54:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 13 13:05:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 13:13:34 india kernel: php-fpm[2199002]: segfault at 7f3a1c4a4d1e ip 00007f3a28b37777 sp 00007fffc0f7ed08 error 4 in opcache.so[7f3a28b00000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.115
country_id: 298795
description:
May 13 13:15:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.140.113
country_id: 690791
description:
May 13 13:15:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.140.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 13:19:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 13:25:40 india kernel: php-fpm[2201785]: segfault at 7f3a1c4a4d1e ip 00007f3a28b37777 sp 00007fffc0f7ed08 error 4 in opcache.so[7f3a28b00000+e4000]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 49.43.5.217
country_id: 1269750
description:
[2026-05-13 13:37:21 +0200] info [cpaneld] 49.43.5.217 NEW bechomaxx:hZblfizwnXpg6pDK address=49.43.5.217,app=cpaneld,creator=bechomaxx,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2026-05-13 13:52:28 dovecot_login authenticator failed for H=([192.111.143.93]) [203.128.10.138]:37553: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.10.138
country_id: 1168579
description:
May 13 13:52:26 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.10.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.122.218
country_id: 3865483
description:
May 13 14:39:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.122.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.122.218
country_id: 3865483
description:
May 13 14:39:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.122.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.170
country_id: 99237
description:
May 13 15:06:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-05-13 15:06:32 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [65.20.251.170]:50092: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.131
country_id: 298795
description:
May 13 15:13:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.131
country_id: 298795
description:
May 13 15:13:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.131 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 15:42:00 india kernel: php-fpm[2211179]: segfault at 7f3a1c4a4d1e ip 00007f3a28b37777 sp 00007fffc0f7ed08 error 4 in opcache.so[7f3a28b00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 15:44:31 india kernel: php-fpm[2209632]: segfault at 7f3a1c4a4d1e ip 00007f3a28b37777 sp 00007fffc0f7e208 error 4 in opcache.so[7f3a28b00000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 17:09:16 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:38:11 india sshd[2235488]: Accepted publickey for root from 171.60.138.162 port 60796 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:38:33 india sshd[2235603]: Accepted publickey for root from 171.60.138.162 port 60807 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:40:13 india sshd[2236116]: Accepted publickey for root from 171.60.138.162 port 60865 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:41:02 india sshd[2236218]: Accepted publickey for root from 171.60.138.162 port 60900 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:41:33 india sshd[2236442]: Accepted publickey for root from 171.60.138.162 port 60929 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 17:45:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:46:00 india sshd[2237303]: Accepted publickey for root from 171.60.138.162 port 61081 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.143.47
country_id: 690791
description:
May 13 17:46:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.143.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.9.198
country_id: 3469034
description:
May 13 17:47:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.9.198 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:46:39 india sshd[2237573]: Accepted publickey for root from 171.60.138.162 port 61108 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.197.193
country_id: 3865483
description:
May 13 17:46:47 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.197.193 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:49:23 india sshd[2238015]: Accepted publickey for root from 171.60.138.162 port 61191 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:49:57 india sshd[2238100]: Accepted publickey for root from 171.60.138.162 port 61211 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:50:39 india sshd[2238300]: Accepted publickey for root from 171.60.138.162 port 61236 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:53:03 india sshd[2238747]: Accepted publickey for root from 171.60.138.162 port 61316 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 17:53:54 india sshd[2238997]: Accepted publickey for root from 171.60.138.162 port 61344 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 18:11:46 india sshd[2241426]: Accepted publickey for root from 171.60.138.162 port 61907 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 18:16:43 india sshd[2242530]: Accepted publickey for root from 171.60.138.162 port 62064 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 13 18:17:35 india sshd[2242756]: Accepted publickey for root from 171.60.138.162 port 62097 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 18:20:41 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 13 18:25:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.213.236.66
country_id: 6252001
description:
May 13 18:38:24 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.213.236.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-05-13 18:38:26 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (oraniffid) [73.213.236.66]:38016: 535 Incorrect authentication data (set_id=dev@cyberelite.in)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 18:39:47 india kernel: php-fpm[2245510]: segfault at 1 ip 0000000000000001 sp 00007fffc0f82d90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 18:40:37 india kernel: php-fpm[2245662]: segfault at 7f3a1bd78b2e ip 00007f3a28b37777 sp 00007fffc0f7ed08 error 4 in opcache.so[7f3a28b00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 18:45:11 india kernel: php-fpm[2246224]: segfault at 3 ip 0000000000000003 sp 00007fffc0f82d90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 18:47:24 india kernel: php-fpm[2245694]: segfault at 7f3a1bd78b2e ip 00007f3a28b37777 sp 00007fffc0f7e908 error 4 in opcache.so[7f3a28b00000+e4000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.36.149.75
country_id: 6251999
description:
[2026-05-13 18:49:16 +0200] info [whostmgrd] 104.36.149.75 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 18:49:38 india kernel: php-fpm[2246677]: segfault at 3 ip 0000000000000003 sp 00007fffc0f82d90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 18:54:21 india kernel: php-fpm[2247302]: segfault at 3 ip 0000000000000003 sp 00007fffc0f82d90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 18:55:18 india kernel: php-fpm[2247414]: segfault at 3 ip 0000000000000003 sp 00007fffc0f82d90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 18:55:46 india kernel: php-fpm[2247447]: segfault at 3 ip 0000000000000003 sp 00007fffc0f82d90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
country_id: 3996063
description:
May 13 18:56:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 18:56:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 13 18:56:47 india sshd[2247527]: Accepted publickey for root from 103.84.70.112 port 62251 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.172.43.114
country_id: 1605651
description:
May 13 18:57:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.172.43.114 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 13 18:58:20 india sshd[2247955]: Accepted publickey for root from 103.84.70.112 port 62305 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 18:58:46 india kernel: php-fpm[2248109]: segfault at 3 ip 0000000000000003 sp 00007fffc0f82d90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 13 18:58:44 india sshd[2248048]: Accepted publickey for root from 103.84.70.112 port 62316 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 19:00:07 india kernel: php-fpm[2248702]: segfault at 3 ip 0000000000000003 sp 00007fffc0f82d90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 13 18:59:39 india sshd[2248366]: Accepted publickey for root from 103.84.70.112 port 62345 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.244.218
country_id: 1814991
description:
May 13 19:00:09 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.244.218 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 19:01:19 india kernel: php-fpm[2249072]: segfault at 3 ip 0000000000000003 sp 00007fffc0f82d90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 13 19:00:40 india sshd[2248871]: Accepted publickey for root from 103.84.70.112 port 62394 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 13 19:01:37 india sshd[2249089]: Accepted publickey for root from 103.84.70.112 port 62431 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 19:03:01 india kernel: php-fpm[2249399]: segfault at 3 ip 0000000000000003 sp 00007fffc0f82d90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 13 19:03:18 india sshd[2249481]: Accepted publickey for root from 103.84.70.112 port 62491 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 13 19:03:38 india kernel: php-fpm[2249629]: segfault at 3 ip 0000000000000003 sp 00007fffc0f82d90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 13 19:35:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.14.171
country_id: 3469034
description:
May 13 19:39:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.14.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.96.217
country_id: 3469034
description:
May 13 19:38:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.96.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.158.199
country_id: 99237
description:
May 13 19:39:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.158.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 13 20:10:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.43
country_id: 690791
description:
2026-05-13 20:55:27 H=([45.144.212.43]) [45.144.212.43]:55546 F=<dpr@priv8shop.com> rejected RCPT <henktim03@gmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 20:59:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 21:15:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 13 21:19:37 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.155
country_id: 3175395
description:
May 13 21:32:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.162
country_id: 933860
description:
May 13 21:32:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 21:32:56 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.30.84
country_id: 798544
description:
May 13 21:32:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.30.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.155
country_id: 3175395
description:
May 13 21:32:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.133
country_id: 3175395
description:
May 13 21:47:54 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.9
country_id: 3175395
description:
May 13 21:48:13 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 21:52:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.112
country_id: 99237
description:
May 13 22:07:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.112
country_id: 99237
description:
May 13 22:07:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.36
country_id: 3175395
description:
May 13 22:07:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.229.245.46
country_id: 3017382
description:
May 13 22:10:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.229.245.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 22:11:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.171.27.248
country_id: 1814991
description:
May 13 22:21:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.171.27.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2026-05-13 22:21:41 dovecot_login authenticator failed for H=(ps-217-8-226-227.ps.sib.mts.ru) [116.171.27.248]:54156: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.229.245.46
country_id: 3017382
description:
May 13 22:22:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.229.245.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.245.177
country_id: 6252001
description:
May 13 22:27:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.245.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 22:29:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.229.245.46
country_id: 3017382
description:
May 13 22:34:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.229.245.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.213.45.190
country_id: 6252001
description:
[2026-05-13 22:36:09 +0200] info [whostmgrd] 129.213.45.190 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 129.213.45.190
country_id: 6252001
description:
[2026-05-13 22:36:10 +0200] info [whostmgrd] 129.213.45.190 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 13 22:42:37 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 22:42:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 22:46:10 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.229.245.46
country_id: 3017382
description:
May 13 22:46:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.229.245.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.227.245.154
country_id: 690791
description:
May 13 22:50:07 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.227.245.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2026-05-13 22:50:09 dovecot_login authenticator failed for H=([222.69.139.84]) [213.227.245.154]:35362: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 23:01:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.245.177
country_id: 6252001
description:
May 13 23:07:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.245.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 23:16:58 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 13 23:19:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 23:32:04 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.173.34
country_id: 1269750
description:
May 13 23:43:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.173.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.173.34
country_id: 1269750
description:
2026-05-13 23:43:35 dovecot_login authenticator failed for H=([70.166.167.59]) [182.95.173.34]:52252: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 13 23:47:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 00:01:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 00:15:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.199.18
country_id: 1269750
description:
May 14 00:26:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.199.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.18
country_id: 1269750
description:
2026-05-14 00:26:23 dovecot_login authenticator failed for H=([186.201.32.242]) [152.52.199.18]:43900: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 00:29:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 00:43:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.19.107
country_id: 3469034
description:
May 14 00:45:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.19.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.245.177
country_id: 6252001
description:
May 14 01:08:09 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.245.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 14 01:17:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.152.138
country_id: 3469034
description:
May 14 01:53:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.152.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.152.138
country_id: 3469034
description:
May 14 01:53:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.152.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.26
country_id: 3865483
description:
May 14 01:53:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.26 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 194.9.14.99
country_id: 690791
description:
[2026-05-14 02:11:10 +0200] info [whostmgrd] 194.9.14.99 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.9.14.99
country_id: 690791
description:
[2026-05-14 02:11:08 +0200] info [whostmgrd] 194.9.14.99 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 14 02:25:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 14 03:00:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 14 03:01:06 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 14 03:02:24 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 14 03:14:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 14 03:13:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 14 03:15:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 14 03:25:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 14 03:27:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.223.58
country_id: 1269750
description:
May 14 03:29:37 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.58
country_id: 1269750
description:
2026-05-14 03:29:39 dovecot_plain authenticator failed for H=(nonish) [182.95.223.58]:37898: 535 Incorrect authentication data (set_id=career@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 14 03:30:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.215.125.250
country_id: 192950
description:
May 14 03:35:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.215.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-05-14 03:35:45 dovecot_login authenticator failed for H=([49.0.36.122]) [41.215.125.250]:59820: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 14 03:37:18 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 14 03:41:02 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.245.177
country_id: 6252001
description:
May 14 03:41:54 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.245.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 03:44:18 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 14 03:45:10 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.253.248.126
country_id: 130758
description:
May 14 03:48:56 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.253.248.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.43.168
country_id: 1668284
description:
2026-05-14 03:49:38 dovecot_login authenticator failed for H=111-70-43-168.emome-ip.hinet.net (90.pool90-173-78.static.orange.es) [111.70.43.168]:44999: 535 Incorrect authentication data (set_id=upport@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.43.168
country_id: 1668284
description:
May 14 03:49:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.43.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 14 03:54:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 14 03:59:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.145.244.202
country_id: 1814991
description:
May 14 04:08:14 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.145.244.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.83.179.47
country_id: 1819730
description:
May 14 04:14:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.83.179.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.49
country_id: 3469034
description:
May 14 04:14:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.49
country_id: 3469034
description:
May 14 04:14:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.167
country_id: 933860
description:
May 14 04:14:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.93.90
country_id: 1269750
description:
2026-05-14 04:25:31 dovecot_login authenticator failed for H=([152.52.12.201]) [122.186.93.90]:38620: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.186.93.90
country_id: 1269750
description:
May 14 04:25:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.186.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 31.220.89.136
country_id: 3017382
description:
[2026-05-14 04:42:06 +0200] info [whostmgrd] 31.220.89.136 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.220.89.136
country_id: 3017382
description:
[2026-05-14 04:42:06 +0200] info [whostmgrd] 31.220.89.136 - root "GET /cpsess1681318551/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 04:54:16 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.169.213.211
country_id: 732800
description:
May 14 04:57:00 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.169.213.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 05:32:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 06:01:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 06:22:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 06:43:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 07:04:41 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 192.253.248.136
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[156.67.111.41] [Local Port]=[993] [Remote IP Address]=[192.253.248.136] [Remote Port]=[34700] [Authentication Database]=[mail] [Username]=[postmaster@easytravelsworld.com] (30/30 failures) (blocked until [Fri May 15 05:11:24 2026 UTC/Fri May 15 07:11:24 2026 LOCAL])


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.12
country_id: 3469034
description:
May 14 07:12:26 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.12
country_id: 3469034
description:
May 14 07:12:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.12 has been locked due to Imunify RBL


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 172.94.9.205
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[156.67.111.41] [Local Port]=[993] [Remote IP Address]=[172.94.9.205] [Remote Port]=[38862] [Authentication Database]=[mail] [Username]=[test@dronomaticaviation.com] (30/30 failures) (blocked until [Fri May 15 05:18:09 2026 UTC/Fri May 15 07:18:09 2026 LOCAL])


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 07:25:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 07:30:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 07:46:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 08:07:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 49.43.5.78
country_id: 1269750
description:
[2026-05-14 08:09:21 +0200] info [cpaneld] 49.43.5.78 NEW ce:G1DRqT8SfbrZRnf1 address=49.43.5.78,app=cpaneld,creator=ce,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 08:10:16 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 14 08:19:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 08:28:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.195
country_id: 3469034
description:
May 14 08:37:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 08:47:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 08:49:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.36.237.209
country_id: 1269750
description:
[2026-05-14 09:10:16 +0200] info [cpaneld] 49.36.237.209 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 49.36.237.209
country_id: 1269750
description:
[2026-05-14 09:10:31 +0200] info [cpaneld] 49.36.237.209 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 09:10:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.118.250.14
country_id: 1269750
description:
[2026-05-14 09:13:40 +0200] info [cpaneld] 111.118.250.14 - oceanhospitals "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.207.14.244
country_id: 2017370
description:
2026-05-14 09:22:33 dovecot_login authenticator failed for H=(178.170.251.102.leadertelecom.ru) [178.207.14.244]:43994: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 09:23:18 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 171.60.138.162
country_id: 1269750
description:
[2026-05-14 09:34:28 +0200] info [whostmgrd] 171.60.138.162 - root "GET /cpsess3869505731/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [103.84.70.112] != Current IP Address [171.60.138.162]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 111.118.250.14
country_id: 1269750
description:
[2026-05-14 09:53:27 +0200] info [cpaneld] 111.118.250.14 NEW oceanhospitals:1oKHK0yesEhJCZbU address=111.118.250.14,app=cpaneld,creator=oceanhospitals,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.204.101
country_id: 1269750
description:
[2026-05-14 09:55:41 +0200] info [webmaild] 106.222.204.101 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.204.101
country_id: 1269750
description:
[2026-05-14 09:56:38 +0200] info [webmaild] 106.222.204.101 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.171.189.184
country_id: 1269750
description:
[2026-05-14 09:56:55 +0200] info [webmaild] 103.171.189.184 - amruttbhatt@bechomaxx.com "POST /cpsess5337474932/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [122.179.90.53] != Current IP Address [103.171.189.184]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 09:58:02 india auth[2371163]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.181.101.195
country_id: 1269750
description:
[2026-05-14 10:04:02 +0200] info [webmaild] 122.181.101.195 - info@headley.in "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.181.101.195
country_id: 1269750
description:
[2026-05-14 10:04:01 +0200] info [webmaild] 122.181.101.195 - info@headley.in "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
May 14 10:06:58 india dovecot[2376633]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.170.99.195
country_id: 1269750
description:
May 14 10:07:49 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.170.99.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2026-05-14 10:07:51 dovecot_login authenticator failed for H=([186.148.187.170]) [122.170.99.195]:36491: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.46.120.38
country_id: 1168579
description:
2026-05-14 10:17:27 dovecot_plain authenticator failed for H=(V4836VC8A) [39.46.120.38]:62184: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.46.120.38
country_id: 1168579
description:
2026-05-14 10:17:33 dovecot_login authenticator failed for H=(V4836VC8A) [39.46.120.38]:62184: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 10:23:41 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 10:36:52 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.36.237.209
country_id: 1269750
description:
[2026-05-14 10:43:55 +0200] info [cpaneld] 49.36.237.209 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.111
country_id: 3469034
description:
May 14 10:50:00 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 10:50:06 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.93.123
country_id: 2510769
description:
May 14 10:50:23 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.143.93.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.93.123
country_id: 2510769
description:
May 14 10:50:36 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.143.93.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.202.72.228
country_id: 1269750
description:
[2026-05-14 10:55:42 +0200] info [webmaild] 106.202.72.228 - director@oceanhospitals.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
country_id: 1835841
description:
May 14 10:56:48 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.170.126
country_id: 1814991
description:
May 14 10:57:19 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.170.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.193.127
country_id: 1814991
description:
May 14 10:58:27 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.193.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 11:03:19 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.186.198
country_id: 1269750
description:
2026-05-14 11:04:37 dovecot_plain authenticator failed for H=(nomon) [182.95.186.198]:52252: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.186.198
country_id: 1269750
description:
May 14 11:04:35 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.186.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 14 11:10:07 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 11:16:32 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.171.189.184
country_id: 1269750
description:
[2026-05-14 11:20:22 +0200] info [cpaneld] 103.171.189.184 NEW ce:M033lrKarSozq_ve address=103.171.189.184,app=cpaneld,creator=ce,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.245.177
country_id: 6252001
description:
May 14 11:25:51 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.245.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 11:29:45 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 11:43:04 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 14 11:49:11 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.76.244.152
country_id: 6252001
description:
[2026-05-14 11:53:30 +0200] info [whostmgrd] 45.76.244.152 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 12:19:50 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 12:22:50 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 14 12:28:44 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 12:36:07 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.181.101.195
country_id: 1269750
description:
[2026-05-14 12:37:39 +0200] info [webmaild] 122.181.101.195 - info@headley.in "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.5.78
country_id: 1269750
description:
[2026-05-14 12:37:45 +0200] info [cpaneld] 49.43.5.78 - amrutdrumcircle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 12:49:22 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 12:54:45 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 13:02:41 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.150.28.13
country_id: 2658434
description:
May 14 13:15:52 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.150.28.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 13:15:58 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.132
country_id: 1733045
description:
2026-05-14 13:22:33 dovecot_login authenticator failed for H=([211.186.41.227]) [49.124.142.132]:40420: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 13:29:16 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 13:42:31 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 13:55:47 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.181.101.195
country_id: 1269750
description:
[2026-05-14 13:59:11 +0200] info [webmaild] 122.181.101.195 - info@headley.in "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.129.64.152
country_id: 6252001
description:
May 14 14:03:16 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.129.64.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 14:09:03 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.51
country_id: 2921044
description:
May 14 14:09:21 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.51
country_id: 2921044
description:
May 14 14:09:34 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 14 14:22:16 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.204.101
country_id: 1269750
description:
[2026-05-14 14:37:10 +0200] info [webmaild] 106.222.204.101 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.50.145.59
country_id: 2750405
description:
May 14 14:40:38 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.50.145.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 14:44:33 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.82
country_id: 226074
description:
May 14 14:45:42 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.39
country_id: 3175395
description:
May 14 14:46:03 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 15:05:09 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 15:14:51 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.204.101
country_id: 1269750
description:
[2026-05-14 15:16:31 +0200] info [webmaild] 106.222.204.101 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 171.60.138.162
country_id: 1269750
description:
[2026-05-14 15:19:03 +0200] info [cpaneld] 171.60.138.162 NEW devcyberelite:FEQzFqPApOPzVQRS address=171.60.138.162,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 171.60.138.162
country_id: 1269750
description:
[2026-05-14 15:19:15 +0200] info [cpaneld] 171.60.138.162 - devcyberelite "POST /cpsess5966811535/3rdparty/phpMyAdmin/index.php?route=/ HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.62
country_id: 2750405
description:
May 14 15:40:54 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 15:43:01 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 15:46:32 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 16:07:04 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 16:07:16 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 14 16:09:35 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 16:27:44 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.119.81
country_id: 6252001
description:
May 14 16:40:47 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.119.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 17:09:17 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-05-14 17:21:27 dovecot_login authenticator failed for H=([192.252.211.196]) [14.38.177.105]:43463: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.38.177.105
country_id: 1835841
description:
May 14 17:21:25 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.38.177.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.227.90.205
country_id: 3469034
description:
2026-05-14 17:25:39 dovecot_login authenticator failed for H=([68.71.243.10]) [148.227.90.205]:44791: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 14 17:27:15 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 17:30:06 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.35.15
country_id: 1643084
description:
[2026-05-14 17:38:03 +0200] info [whostmgrd] 182.9.35.15 - 2083logince "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.204.101
country_id: 1269750
description:
[2026-05-14 17:44:52 +0200] info [webmaild] 106.222.204.101 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 17:50:57 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.66
country_id: 2750405
description:
May 14 17:51:03 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 14 17:55:50 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 18:11:54 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.233
country_id: 690791
description:
2026-05-14 18:20:52 H=([77.83.39.233]) [77.83.39.233]:50238 F=<dpr@priv8shop.com> rejected RCPT <bar_hockman@yahoo.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.204.101
country_id: 1269750
description:
[2026-05-14 18:44:29 +0200] info [webmaild] 106.222.204.101 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.65.36
country_id: 3469034
description:
May 14 19:11:33 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.252.65.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.230.208.147
country_id: 2658434
description:
May 14 19:23:16 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.230.208.147 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.82
country_id: 6252001
description:
47.251.188.82 - - [14/May/2026:19:26:10 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791890&pdata=https%253A%252F%252Fwww.amrutdrumcircle.com%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778779566 HTTP/2.0" 302 0 www.amrutdrumcircle.com "https://www.amrutdrumcircle.com:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.245.177
country_id: 6252001
description:
May 14 19:43:41 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.172.245.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.177
country_id: 3469034
description:
May 14 19:48:41 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.10.108.159
country_id: 3469034
description:
May 14 19:49:18 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.10.108.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.50
country_id: 3469034
description:
May 14 19:49:42 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 14 21:04:37 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 21:20:04 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 14 21:40:17 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 21:40:52 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.99
country_id: 1269750
description:
May 14 21:48:09 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.226
country_id: 3175395
description:
May 14 21:47:50 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.131.20
country_id: 99237
description:
May 14 21:49:04 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.131.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 22:02:17 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.240.151.98
country_id: 1814991
description:
2026-05-14 22:19:15 dovecot_login authenticator failed for H=([116.236.43.254]) [114.240.151.98]:46992: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.240.151.98
country_id: 1814991
description:
May 14 22:19:13 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.240.151.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.153
country_id: 1733045
description:
2026-05-14 22:19:04 dovecot_login authenticator failed for H=([24.142.170.231]) [49.124.152.153]:44614: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.14.171
country_id: 3469034
description:
May 14 22:34:03 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.14.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.12.99
country_id: 2921044
description:
May 14 22:50:35 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.12.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.242
country_id: 2921044
description:
May 14 22:52:50 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.107.191
country_id: 3469034
description:
May 14 22:54:47 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.107.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.205.233.234
country_id: 1814991
description:
May 14 23:05:25 india auth[2376648]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.205.233.234 has been locked due to Imunify RBL


