# incident

plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.114.172
country_id: 1814991
description:
May  3 14:08:11 india sshd[133594]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.114.172


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:08:17 india sshd[133676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 156.238.252.133
country_id: 241170
description:
Login Blocked: IP reached maximum auth failures [Service]=[sshd] [Remote IP Address]=[156.238.252.133] [Authentication Database]=[system] [Username]=[ubuntu] (5/5 failures) (blocked until [Sun May  3 11:46:59 2026 UTC/Sun May  3 13:46:59 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 161.97.87.163
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures [Service]=[sshd] [Remote IP Address]=[161.97.87.163] [Authentication Database]=[system] [Username]=[ubuntu] (5/5 failures) (blocked until [Sun May  3 11:47:50 2026 UTC/Sun May  3 13:47:50 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 45.82.13.133
country_id: 2750405
description:
Login Blocked: IP reached maximum auth failures [Service]=[sshd] [Remote IP Address]=[45.82.13.133] [Authentication Database]=[system] [Username]=[root] (5/5 failures) (blocked until [Sun May  3 12:17:49 2026 UTC/Sun May  3 14:17:49 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 186.146.235.58
country_id: 3686110
description:
Login Blocked: IP reached maximum auth failures [Service]=[sshd] [Remote IP Address]=[186.146.235.58] [Authentication Database]=[system] [Username]=[sambauser] (5/5 failures) (blocked until [Sun May  3 11:49:38 2026 UTC/Sun May  3 13:49:38 2026 LOCAL])


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
May  3 14:08:31 india dovecot[134014]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.137.221.164
country_id: 3469034
description:
May  3 14:09:07 india sshd[134824]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.137.221.164


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:09:27 india sshd[135171]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.137.221.164
country_id: 3469034
description:
May  3 14:09:07 india sshd[134824]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.137.221.164 has been locked due to Imunify RBL


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
May  3 14:10:03 india dovecot[135513]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.168
country_id: 798549
description:
May  3 14:10:07 india sshd[135535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.168


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.114.172
country_id: 1814991
description:
May  3 14:09:35 india sshd[135205]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.114.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:10:02 india sshd[135476]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.20.210.185
country_id: 2921044
description:
May  3 14:10:21 india sshd[135677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.20.210.185  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.114.172
country_id: 1814991
description:
May  3 14:09:35 india sshd[135205]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.114.172


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:10:03 india sshd[135476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:10:39 india sshd[135733]: Failed password for invalid user admin from 45.82.13.133 port 34096 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:10:37 india sshd[135733]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:10:37 india sshd[135733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.137.221.164
country_id: 3469034
description:
May  3 14:13:28 india sshd[136232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.137.221.164  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:13:00 india sshd[135930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:13:00 india sshd[135930]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.137.221.164
country_id: 3469034
description:
May  3 14:13:28 india sshd[136232]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.137.221.164 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
May  3 14:13:49 india sshd[136257]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:13:59 india sshd[136277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=rpc


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:13:59 india sshd[136277]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.100.206.28
country_id: 2635167
description:
May  3 14:14:04 india auth[135526]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.100.206.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:14:34 india sshd[136340]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:14:34 india sshd[136340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:15:39 india sshd[136539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:15:39 india sshd[136539]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.175.122
country_id: 1814991
description:
May  3 14:16:09 india sshd[136598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.175.122


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.175.122
country_id: 1814991
description:
May  3 14:16:09 india sshd[136598]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:17:19 india sshd[136830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.222.116


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:17:19 india sshd[136830]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.222.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:16:49 india sshd[136727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:16:49 india sshd[136727]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:18:00 india sshd[137024]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:17:39 india sshd[136952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:17:46 india sshd[136981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.222.116  user=root


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 45.82.13.133
country_id: 2750405
description:
Login Blocked: IP reached maximum auth failures [Service]=[sshd] [Remote IP Address]=[45.82.13.133] [Authentication Database]=[system] [Username]=[nobody] (17/5 failures) (blocked until [Sun May  3 12:33:00 2026 UTC/Sun May  3 14:33:00 2026 LOCAL])


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.137.221.164
country_id: 3469034
description:
May  3 14:17:41 india sshd[136944]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.137.221.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.137.221.164
country_id: 3469034
description:
May  3 14:17:41 india sshd[136944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.137.221.164  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:18:00 india sshd[137024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=nobody


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:17:46 india sshd[136981]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.222.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:18:33 india sshd[137172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:18:33 india sshd[137172]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:19:07 india sshd[137319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.222.116


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:19:07 india sshd[137319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.222.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:19:23 india sshd[137367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224


plugin: ossec
rule: 11325
name: Active Response. Stealth SSHD brute force attack detected
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:18:36 india sshd[137172]: Failed password for invalid user kali from 45.82.13.133 port 35196 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:19:44 india sshd[137598]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:19:44 india sshd[137598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:20:26 india sshd[137895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:20:55 india sshd[138083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:20:55 india sshd[138083]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:20:32 india sshd[137961]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.222.116


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:20:32 india sshd[137961]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.222.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:20:38 india sshd[138018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224  user=root


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 116.110.4.224
country_id: 1562822
description:
Login Blocked: IP reached maximum auth failures [Service]=[sshd] [Remote IP Address]=[116.110.4.224] [Authentication Database]=[system] [Username]=[root] (5/5 failures) (blocked until [Sun May  3 12:36:52 2026 UTC/Sun May  3 14:36:52 2026 LOCAL])


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:21:55 india sshd[138664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.222.116


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 116.110.222.116
country_id: 1562822
description:
Login Blocked: IP reached maximum auth failures [Service]=[sshd] [Remote IP Address]=[116.110.222.116] [Authentication Database]=[system] [Username]=[root] (5/5 failures) (blocked until [Sun May  3 12:36:57 2026 UTC/Sun May  3 14:36:57 2026 LOCAL])


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:21:52 india sshd[138647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:21:55 india sshd[138664]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.222.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.137.221.164
country_id: 3469034
description:
May  3 14:22:02 india sshd[138669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.137.221.164  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.137.221.164
country_id: 3469034
description:
May  3 14:22:02 india sshd[138669]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.137.221.164 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:22:49 india sshd[139255]: Failed password for invalid user system from 116.110.222.116 port 42570 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:23:01 india sshd[139437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:22:51 india sshd[139288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:22:51 india sshd[139288]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:22:48 india sshd[139255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.222.116


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:22:48 india sshd[139255]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.222.116 has been locked due to Imunify RBL


plugin: ossec
rule: 5902
name: New user added to the system
description:
May  3 14:23:41 india useradd[139906]: new user: name=redis, UID=971, GID=967, home=/var/lib/redis, shell=/sbin/nologin


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 45.82.13.133
country_id: 2750405
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[sshd] [Remote IP Address]=[45.82.13.133] [Authentication Database]=[system] [Username]=[root] (30/30 failures) (blocked until [Mon May  4 12:23:26 2026 UTC/Mon May  4 14:23:26 2026 LOCAL])


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:24:14 india sshd[140640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.222.116


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:23:59 india sshd[140515]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:23:59 india sshd[140515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:24:10 india sshd[140553]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.4.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.222.116
country_id: 1562822
description:
May  3 14:24:14 india sshd[140640]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.222.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:24:10 india sshd[140553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:24:42 india sshd[140985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:24:42 india sshd[140985]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.4.224 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:24:34 india sshd[140832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:24:34 india sshd[140832]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:25:43 india sshd[141895]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.13.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.13.133
country_id: 2750405
description:
May  3 14:25:43 india sshd[141895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.13.133  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:25:56 india sshd[141959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:25:56 india sshd[141959]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.4.224 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:25:58 india sshd[141959]: Failed password for invalid user admin from 116.110.4.224 port 43724 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:29:04 india sshd[142640]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.4.224 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:29:04 india sshd[142640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:30:47 india sshd[143386]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.4.224 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:30:47 india sshd[143386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:31:58 india sshd[143812]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.4.224 has been locked due to Imunify RBL


plugin: ossec
rule: 11325
name: Active Response. Stealth SSHD brute force attack detected
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:32:01 india sshd[143812]: Failed password for invalid user ftpuser from 116.110.4.224 port 41700 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:31:58 india sshd[143812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:33:20 india sshd[143812]: Connection reset by invalid user ftpuser 116.110.4.224 port 41700 [preauth]


plugin: modsec
rule: 77093094
abuser: 3.239.249.130
country_id: 6252001
domain: www.india.myserverlogin.in
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.02||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:43:35 india sshd[148231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:43:35 india sshd[148231]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.4.224 has been locked due to Imunify RBL


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 116.110.4.224
country_id: 1562822
description:
Login Blocked: IP reached maximum auth failures [Service]=[sshd] [Remote IP Address]=[116.110.4.224] [Authentication Database]=[system] [Username]=[matrix] (5/5 failures) (blocked until [Sun May  3 12:58:35 2026 UTC/Sun May  3 14:58:35 2026 LOCAL])


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:45:09 india sshd[148586]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.110.4.224 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:45:11 india sshd[148586]: Failed password for invalid user test from 116.110.4.224 port 57740 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.110.4.224
country_id: 1562822
description:
May  3 14:45:09 india sshd[148586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.110.4.224


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 14.191.244.226
country_id: 1562822
domain: amruttbhatt.com
description:
IM360 WAF: Bad file extension||RSV:8.02||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/www.amruttbhatt.com||User:root||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 146.190.63.248
country_id: 6252001
description:
[2026-05-03 14:52:53 +0200] info [whostmgrd] 146.190.63.248 - root "GET /403.shtml HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.63.248
country_id: 6252001
description:
[2026-05-03 14:52:50 +0200] info [whostmgrd] 146.190.63.248 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77538918
name: IM360 WAF: WHM auth bypass via stripped session cookie (cookie-strip-only variant, WPT-2497)
abuser: 146.190.63.248
country_id: 6252001
domain: whm.amruttbhatt.com
description:
IM360 WAF: WHM auth bypass via stripped session cookie (cookie-strip-only variant, WPT-2497)||MV:/cpsess4105551788/json-api/listaccts?api.version=1||StrippedCookie:%3AeDGryVcfNAMsHytQ||UA:Mozilla/5.0 (l9scan/2.0.1343e2131313e27363e2635313; +https://leakix.net)||Method:GET||RSV:8.02||T:APACHE||


plugin: modsec
rule: 77538918
name: IM360 WAF: WHM auth bypass via stripped session cookie (cookie-strip-only variant, WPT-2497)
abuser: 146.190.63.248
country_id: 6252001
domain: whm.amrutdrumcircle.com
description:
IM360 WAF: WHM auth bypass via stripped session cookie (cookie-strip-only variant, WPT-2497)||MV:/cpsess8835896943/json-api/listaccts?api.version=1||StrippedCookie:%3AsiexpecZcyaqzTNt||UA:Mozilla/5.0 (l9scan/2.0.1343e2131313e27363e2635313; +https://leakix.net)||Method:GET||RSV:8.02||T:APACHE||


plugin: ossec
rule: 5403
name: First time user executed sudo.
description:
May  3 14:54:13 india sudo[150377]: wp-toolkit : PWD=/usr/local/cpanel/3rdparty/wp-toolkit/htdocs ; USER=ce ; COMMAND=/bin/test -e /home/ce/public_html/


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 38.47.180.240
country_id: 1643084
description:
[2026-05-03 15:09:22 +0200] info [whostmgrd] 38.47.180.240 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.47.180.240
country_id: 1643084
description:
[2026-05-03 15:09:21 +0200] info [whostmgrd] 38.47.180.240 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.100.206.28
country_id: 2635167
description:
May  3 15:11:20 india auth[149840]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.100.206.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 149.143.137.4
country_id: 6252001
domain: www.cyberelite.in
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.02||T:APACHE||MV:.env~||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.122.45
country_id: 1880251
domain: cyberelite.in
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.02||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.4
country_id: 2395170
description:
May  3 15:22:21 india auth[158641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.4
country_id: 2395170
description:
May  3 15:22:35 india auth[158641]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 172.71.172.86
country_id: 2921044
domain: dev.cyberelite.work
description:
IM360 WAF: Bad file extension||RSV:8.02||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:devcyberelite||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.5.193
country_id: 1269750
description:
[2026-05-03 15:46:52 +0200] info [cpaneld] 49.43.5.193 - ce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.5.193
country_id: 1269750
description:
[2026-05-03 15:50:11 +0200] info [cpaneld] 49.43.5.193 - ce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.5.193
country_id: 1269750
description:
[2026-05-03 15:50:53 +0200] info [cpaneld] 49.43.5.193 - ce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.5.193
country_id: 1269750
description:
[2026-05-03 15:54:47 +0200] info [cpaneld] 49.43.5.193 - ce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 54.169.120.62
country_id: 1880251
domain: 156.67.111.41
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env||RSV:8.02||T:APACHE||


plugin: ossec
rule: 5403
name: First time user executed sudo.
description:
May  3 15:59:54 india sudo[170690]:    root : TTY=pts/0 ; PWD=/home/ce/public_html ; USER=ce ; COMMAND=/usr/local/bin/wp search-replace https://dev.cyberelite.work/ceplwebsite https://cyberelite.in --all-tables --precise --skip-columns=guid


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 223.185.16.74
country_id: 1269750
description:
[2026-05-03 16:10:36 +0200] info [whostmgrd] 223.185.16.74 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.185.16.74
country_id: 1269750
description:
[2026-05-03 16:10:36 +0200] info [whostmgrd] 223.185.16.74 - root "GET /cpsess8336888017/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.245.197.146
country_id: 2510769
description:
2026-05-03 16:40:16 dovecot_plain authenticator failed for H=(localhost) [168.245.197.146]:58505: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.245.197.146
country_id: 2510769
description:
May  3 16:40:14 india auth[161969]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.245.197.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.170
country_id: 3469034
description:
May  3 16:57:10 india auth[161969]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.61.134
country_id: 3469034
description:
May  3 16:57:37 india auth[161969]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.61.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.100.206.28
country_id: 2635167
description:
May  3 17:06:18 india auth[161969]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.100.206.28 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.59.28.26
country_id: 1269750
description:
[2026-05-03 17:12:38 +0200] info [webmaild] 152.59.28.26 - info@headley.in "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.59.28.26
country_id: 1269750
description:
[2026-05-03 17:13:55 +0200] info [webmaild] 152.59.28.26 - info@headley.in "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.59.30.82
country_id: 1269750
description:
[2026-05-03 17:13:36 +0200] info [webmaild] 152.59.30.82 - info@headley.in "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.195.192.145
country_id: 1880251
description:
[2026-05-03 17:26:11 +0200] info [whostmgrd] 216.195.192.145 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID vhv6mw) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 216.195.192.145
country_id: 1880251
description:
[2026-05-03 17:26:13 +0200] info [whostmgrd] 216.195.192.145 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.222.215.154
country_id: 1269750
description:
[2026-05-03 17:50:18 +0200] info [whostmgrd] 88.222.215.154 - root "GET /cpsess6808902329/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 88.222.215.154
country_id: 1269750
description:
[2026-05-03 17:50:17 +0200] info [whostmgrd] 88.222.215.154 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.133.117.190
country_id: 6252001
domain: dronomaticaviation.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.02||T:APACHE||MV:/wp-admin/setup-config.php/wp-json/wp/v2/users/||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.100.206.28
country_id: 2635167
description:
May  3 18:05:13 india auth[161969]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.100.206.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.252.56.160
country_id: 1562822
domain: www.amrutdrumcircle.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.amrutdrumcircle.com/ HTTP/1.1||RSV:8.02||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.80
country_id: 3469034
description:
May  3 18:13:13 india auth[161969]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.89
country_id: 3469034
description:
May  3 18:13:42 india auth[161969]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.89 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.177.106.184
country_id: 1880251
domain: oceanhospitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.02||T:APACHE||RA:34.177.106.184||TA:34.177.106.184||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.196.228.141
country_id: 6252001
domain: bechomaxx.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/133.0.6943.0 Safari/537.36||RSV:8.02||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.207.226.222
country_id: 1269750
description:
[2026-05-03 18:48:41 +0200] info [cpaneld] 106.207.226.222 - saifyglasshouse "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.100.206.28
country_id: 2635167
description:
May  3 19:04:00 india auth[227823]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.100.206.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 20.9.17.31
country_id: 6252001
domain: headley.in
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/as.php||WPU:||RSV:8.02||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.9.17.31
country_id: 6252001
domain: headley.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.02||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/headley/public_html/wp-content/uploads/2021/02||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.140.121
country_id: 3017382
description:
May  3 20:23:43 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.140.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.165.222
country_id: 3017382
description:
[2026-05-03 20:25:33 +0200] info [whostmgrd] 104.28.165.222 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.165.222
country_id: 3017382
description:
[2026-05-03 20:25:34 +0200] info [whostmgrd] 104.28.165.222 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.180.125.6
country_id: 6252001
description:
May  3 20:29:20 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.180.125.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.96.61.68
country_id: 1562822
description:
[2026-05-03 20:30:04 +0200] info [whostmgrd] 42.96.61.68 - root "GET /json-api/create_user_session?api.version=1&user=root&service=whostmgrd HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  3 21:57:04 india kernel: php-fpm[280955]: segfault at 7f1d91d179b6 ip 00007f1d9e337777 sp 00007ffc04d3cb48 error 4 in opcache.so[7f1d9e300000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.105
country_id: 3469034
description:
May  3 22:21:33 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.138
country_id: 3469034
description:
May  3 22:22:19 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.138
country_id: 3469034
description:
May  3 22:22:33 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.103.120.150
country_id: 1819730
description:
May  4 01:03:13 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.103.120.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.100.84
country_id: 1269750
description:
May  4 01:02:47 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.100.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.91.153.26
country_id: 3077311
description:
May  4 01:04:12 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.91.153.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.206.131.33
country_id: 1269750
description:
May  4 01:04:22 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.206.131.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.206.131.33
country_id: 1269750
description:
May  4 01:04:32 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.206.131.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.101.189.149
country_id: 3579143
description:
2026-05-04 03:39:56 dovecot_plain authenticator failed for H=149.189.101.199.dyn-ip.dtfibre.fr (1J0G627F) [199.101.189.149]:23389: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.42.242.9
country_id: 1643084
description:
[2026-05-04 03:43:11 +0200] info [cpaneld] 103.42.242.9 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.42.242.9
country_id: 1643084
description:
[2026-05-04 03:43:11 +0200] info [whostmgrd] 103.42.242.9 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  4 03:46:05 india kernel: php-fpm[331783]: segfault at 7 ip 0000000000000007 sp 00007ffc04d40f90 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 23.97.62.117
country_id: 1880251
description:
[2026-05-04 05:19:33 +0200] info [whostmgrd] 23.97.62.117 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.97.62.117
country_id: 1880251
description:
[2026-05-04 05:19:32 +0200] info [whostmgrd] 23.97.62.117 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.247.97.9
country_id: 1282988
description:
[2026-05-04 05:34:55 +0200] info [whostmgrd] 84.247.97.9 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 84.247.97.9
country_id: 1282988
description:
[2026-05-04 05:34:55 +0200] info [whostmgrd] 84.247.97.9 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.247.97.9
country_id: 1282988
description:
[2026-05-04 05:36:57 +0200] info [whostmgrd] 84.247.97.9 - root "GET /cpsess7641469279/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 84.247.97.9
country_id: 1282988
description:
[2026-05-04 05:36:56 +0200] info [whostmgrd] 84.247.97.9 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.192.130.192
country_id: 1168579
description:
2026-05-04 06:33:03 dovecot_plain authenticator failed for H=(Z69Q27X) [154.192.130.192]:22781: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.216
country_id: 3469034
description:
May  4 06:49:24 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.216
country_id: 3469034
description:
May  4 06:49:32 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.216 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  4 07:59:46 india kernel: php-fpm[366827]: segfault at ffffffff000002d0 ip ffffffff000002d0 sp 00007ffc04d40f90 error 15


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  4 08:00:53 india kernel: php-fpm[367208]: segfault at ffffffff000002d0 ip ffffffff000002d0 sp 00007ffc04d40f90 error 15


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.207.214.192
country_id: 1269750
description:
[2026-05-04 08:29:30 +0200] info [cpaneld] 106.207.214.192 - saifyglasshouse "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [106.207.226.222] != Current IP Address [106.207.214.192]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.121.95.175
country_id: 3469034
description:
May  4 09:09:00 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.121.95.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.187.149.102
country_id: 2464461
description:
[2026-05-04 10:50:20 +0200] info [whostmgrd] 196.187.149.102 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.191.115.219
country_id: 6252001
description:
[2026-05-04 11:28:03 +0200] info [whostmgrd] 18.191.115.219 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 18.191.115.219
country_id: 6252001
description:
[2026-05-04 11:28:05 +0200] info [whostmgrd] 18.191.115.219 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.140.112
country_id: 732800
description:
May  4 11:28:25 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.140.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.140.112
country_id: 732800
description:
May  4 11:28:38 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.140.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.12.117
country_id: 3469034
description:
May  4 11:28:55 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.12.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.12.91.119
country_id: 6252001
description:
[2026-05-04 11:35:02 +0200] info [whostmgrd] 52.12.91.119 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID a36fua) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 52.12.91.119
country_id: 6252001
description:
[2026-05-04 11:35:06 +0200] info [whostmgrd] 52.12.91.119 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 16.184.25.217
country_id: 1835841
description:
[2026-05-04 11:35:53 +0200] info [whostmgrd] 16.184.25.217 - root "GET /cpsess3664263278/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 16.184.25.217
country_id: 1835841
description:
[2026-05-04 11:35:52 +0200] info [whostmgrd] 16.184.25.217 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.201.39.61
country_id: 1835841
description:
[2026-05-04 11:37:03 +0200] info [whostmgrd] 43.201.39.61 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 43.201.39.61
country_id: 1835841
description:
[2026-05-04 11:37:04 +0200] info [whostmgrd] 43.201.39.61 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.164.178.251
country_id: 1835841
description:
[2026-05-04 11:37:45 +0200] info [whostmgrd] 15.164.178.251 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 15.164.178.251
country_id: 1835841
description:
[2026-05-04 11:37:45 +0200] info [whostmgrd] 15.164.178.251 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 35.94.20.71
country_id: 6252001
description:
[2026-05-04 11:39:05 +0200] info [whostmgrd] 35.94.20.71 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.94.20.71
country_id: 6252001
description:
[2026-05-04 11:39:04 +0200] info [whostmgrd] 35.94.20.71 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.246.22.173
country_id: 6252001
description:
[2026-05-04 11:39:48 +0200] info [whostmgrd] 44.246.22.173 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 44.246.22.173
country_id: 6252001
description:
[2026-05-04 11:39:50 +0200] info [whostmgrd] 44.246.22.173 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.94.151.34
country_id: 6252001
description:
[2026-05-04 11:42:41 +0200] info [whostmgrd] 35.94.151.34 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 35.94.151.34
country_id: 6252001
description:
[2026-05-04 11:42:42 +0200] info [whostmgrd] 35.94.151.34 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.203.107.59
country_id: 1835841
description:
[2026-05-04 11:44:53 +0200] info [whostmgrd] 43.203.107.59 - root "GET /cpsess4207235729/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 43.203.107.59
country_id: 1835841
description:
[2026-05-04 11:44:53 +0200] info [whostmgrd] 43.203.107.59 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.132
country_id: 953987
description:
May  4 14:26:03 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.128.124.91
country_id: 1643084
description:
[2026-05-04 15:23:37 +0200] info [whostmgrd] 34.128.124.91 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 34.128.124.91
country_id: 1643084
description:
[2026-05-04 15:23:37 +0200] info [whostmgrd] 34.128.124.91 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.159.90.64
country_id: 2750405
description:
May  4 15:41:02 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.159.90.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.159.90.64
country_id: 2750405
description:
2026-05-04 15:41:04 dovecot_plain authenticator failed for H=([203.159.90.64]) [203.159.90.64]:61796: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.102.229.209
country_id: 298795
description:
[2026-05-04 16:16:59 +0200] info [whostmgrd] 149.102.229.209 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 149.102.229.209
country_id: 298795
description:
[2026-05-04 16:17:00 +0200] info [whostmgrd] 149.102.229.209 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.5.108.126
country_id: 2186224
description:
May  4 16:42:29 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.5.108.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.5.108.126
country_id: 2186224
description:
May  4 16:42:37 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.5.108.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.12
country_id: 798544
description:
May  4 16:43:09 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.86.88.117
country_id: 6252001
description:
[2026-05-04 17:25:01 +0200] info [whostmgrd] 172.86.88.117 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 172.86.88.117
country_id: 6252001
description:
[2026-05-04 17:25:05 +0200] info [whostmgrd] 172.86.88.117 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.66
country_id: 1269750
description:
2026-05-04 17:51:54 dovecot_plain authenticator failed for H=(noness) [128.185.254.66]:54434: 535 Incorrect authentication data (set_id=career@cyberelite.in)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.179.90.187
country_id: 1269750
description:
[2026-05-04 18:05:27 +0200] info [whostmgrd] 122.179.90.187 - root "GET /cpsess6574234367/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.181.102.5] != Current IP Address [122.179.90.187]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.179.90.187
country_id: 1269750
description:
[2026-05-04 18:12:19 +0200] info [whostmgrd] 122.179.90.187 - root "GET /cpsess6574234367/json-api/loadavg HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [122.181.102.5] != Current IP Address [122.179.90.187]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 122.179.90.187
country_id: 1269750
description:
May  4 18:56:00 india sshd[457851]: Accepted publickey for root from 122.179.90.187 port 6342 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 122.179.90.187
country_id: 1269750
description:
May  4 18:56:50 india sshd[458076]: Accepted publickey for root from 122.179.90.187 port 10337 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 122.179.90.187
country_id: 1269750
description:
May  4 18:57:42 india sshd[458337]: Accepted publickey for root from 122.179.90.187 port 20297 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  4 19:19:50 india kernel: php-fpm[461473]: segfault at 7f5160b19866 ip 00007f516d137777 sp 00007fff23952268 error 4 in opcache.so[7f516d100000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  4 19:39:16 india kernel: php-fpm[463782]: segfault at 7f5160b19866 ip 00007f516d137777 sp 00007fff23951b28 error 4 in opcache.so[7f516d100000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  4 19:41:30 india kernel: php-fpm[464405]: segfault at 7f5160b19866 ip 00007f516d137777 sp 00007fff23951b28 error 4 in opcache.so[7f516d100000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  4 19:44:01 india kernel: php-fpm[464510]: segfault at 7f5160b19866 ip 00007f516d137777 sp 00007fff23951b28 error 4 in opcache.so[7f516d100000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.60.57.172
country_id: 357994
description:
May  4 20:11:22 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.60.57.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.60.57.172
country_id: 357994
description:
2026-05-04 20:11:24 dovecot_plain authenticator failed for H=(58F1THHLM15) [197.60.57.172]:57972: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.43
country_id: 3469034
description:
May  4 20:30:44 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.40
country_id: 3469034
description:
May  5 00:16:40 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.33
country_id: 3175395
description:
May  5 00:17:04 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.5.153.174
country_id: 1562822
description:
May  5 03:14:20 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.5.153.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.5.153.174
country_id: 1562822
description:
2026-05-05 03:14:22 dovecot_plain authenticator failed for H=(1VT5KO7) [117.5.153.174]:55142: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.46.221.231
country_id: 6252001
description:
[2026-05-05 04:13:45 +0200] info [whostmgrd] 38.46.221.231 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 38.46.221.231
country_id: 6252001
description:
[2026-05-05 04:13:47 +0200] info [whostmgrd] 38.46.221.231 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.58.182.144
country_id: 6252001
description:
[2026-05-05 04:21:17 +0200] info [whostmgrd] 38.58.182.144 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 38.58.182.144
country_id: 6252001
description:
[2026-05-05 04:21:19 +0200] info [whostmgrd] 38.58.182.144 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 16.170.255.144
country_id: 2661886
description:
[2026-05-05 05:14:36 +0200] info [whostmgrd] 16.170.255.144 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 16.170.255.144
country_id: 2661886
description:
[2026-05-05 05:14:37 +0200] info [whostmgrd] 16.170.255.144 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.164.192
country_id: 1880251
description:
[2026-05-05 05:20:37 +0200] info [whostmgrd] 152.42.164.192 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 152.42.164.192
country_id: 1880251
description:
[2026-05-05 05:20:38 +0200] info [whostmgrd] 152.42.164.192 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 13.60.173.199
country_id: 2661886
description:
[2026-05-05 05:23:56 +0200] info [whostmgrd] 13.60.173.199 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.60.173.199
country_id: 2661886
description:
[2026-05-05 05:23:55 +0200] info [whostmgrd] 13.60.173.199 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.156.129.187
country_id: 2264397
description:
[2026-05-05 05:25:45 +0200] info [cpaneld] 45.156.129.187 - uca01ff19f1 "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.222.35.229
country_id: 6251999
description:
[2026-05-05 06:02:21 +0200] info [whostmgrd] 15.222.35.229 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 15.222.35.229
country_id: 6251999
description:
[2026-05-05 06:02:23 +0200] info [whostmgrd] 15.222.35.229 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.240.179.212
country_id: 6252001
description:
[2026-05-05 06:39:10 +0200] info [whostmgrd] 162.240.179.212 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 162.240.179.212
country_id: 6252001
description:
[2026-05-05 06:39:12 +0200] info [whostmgrd] 162.240.179.212 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.112.219.27
country_id: 3658394
description:
2026-05-05 06:42:27 dovecot_plain authenticator failed for H=(10I184C09IJ1) [200.112.219.27]:54202: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.112.219.27
country_id: 3658394
description:
2026-05-05 06:42:34 dovecot_login authenticator failed for H=(10I184C09IJ1) [200.112.219.27]:54202: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.179.91.42
country_id: 1269750
description:
[2026-05-05 07:05:03 +0200] info [webmaild] 122.179.91.42 - info@havishia.in "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.179.91.42
country_id: 1269750
description:
[2026-05-05 07:05:34 +0200] info [webmaild] 122.179.91.42 - info@headley.in "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.7.93.135
country_id: 2750405
description:
[2026-05-05 07:57:16 +0200] info [whostmgrd] 34.7.93.135 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 34.7.93.135
country_id: 2750405
description:
[2026-05-05 07:57:18 +0200] info [whostmgrd] 34.7.93.135 - root "GET /scripts2/domainfo HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.156.129.187
country_id: 2264397
description:
[2026-05-05 08:01:52 +0200] info [whostmgrd] 45.156.129.187 - u882ae4bcff "GET /cpsess2629617247/ HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.4.232.80
country_id: 6252001
description:
[2026-05-05 08:08:59 +0200] info [whostmgrd] 69.4.232.80 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 69.4.232.80
country_id: 6252001
description:
[2026-05-05 08:09:02 +0200] info [whostmgrd] 69.4.232.80 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.58.182.144
country_id: 6252001
description:
[2026-05-05 08:46:29 +0200] info [whostmgrd] 38.58.182.144 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 38.58.182.144
country_id: 6252001
description:
[2026-05-05 08:46:32 +0200] info [whostmgrd] 38.58.182.144 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.100
country_id: 3469034
description:
May  5 09:23:34 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.100 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  5 10:35:11 india kernel: php-fpm[592156]: segfault at 7f5160b19866 ip 00007f516d137777 sp 00007fff23951ec8 error 4 in opcache.so[7f516d100000+e4000]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 23.184.88.251
country_id: 6252001
description:
[2026-05-05 10:35:42 +0200] info [whostmgrd] 23.184.88.251 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.184.88.251
country_id: 6252001
description:
[2026-05-05 10:35:38 +0200] info [whostmgrd] 23.184.88.251 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.140.231
country_id: 690791
description:
May  5 11:16:05 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.140.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.123.24
country_id: 3865483
description:
May  5 11:16:26 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.123.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.123.24
country_id: 3865483
description:
May  5 11:16:34 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.123.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.3.35
country_id: 1269750
description:
[2026-05-05 12:03:16 +0200] info [cpaneld] 49.43.3.35 - ce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.115.126
country_id: 1694008
description:
[2026-05-05 12:34:33 +0200] info [whostmgrd] 138.84.115.126 - root "GET /json-api/listaccts?api.version=1 HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
country_id: 3996063
description:
May  5 12:38:59 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
May  5 12:39:47 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.91.164.131
country_id: 3469034
description:
May  5 12:40:36 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.91.164.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.203.84
country_id: 2413451
description:
May  5 12:41:55 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.203.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.134.21
country_id: 1269750
description:
May  5 12:43:01 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.134.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.172
country_id: 3175395
description:
May  5 13:15:06 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.192
country_id: 690791
description:
May  5 13:15:43 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-05-05 13:17:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (rumbany) [87.103.126.54]:33554: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 123.100.137.13
country_id: 1861060
description:
[2026-05-05 16:04:41 +0200] info [whostmgrd] 123.100.137.13 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 123.100.137.13
country_id: 1861060
description:
[2026-05-05 16:04:39 +0200] info [whostmgrd] 123.100.137.13 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.183.74.177
country_id: 6252001
description:
May  5 16:25:50 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.183.74.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-05-05 16:25:52 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (bramicing) [73.183.74.177]:45996: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.38.237.66
country_id: 2921044
description:
[2026-05-05 16:31:57 +0200] info [whostmgrd] 209.38.237.66 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 209.38.237.66
country_id: 2921044
description:
[2026-05-05 16:31:58 +0200] info [whostmgrd] 209.38.237.66 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 38.58.182.144
country_id: 6252001
description:
[2026-05-05 16:41:29 +0200] info [whostmgrd] 38.58.182.144 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.58.182.144
country_id: 6252001
description:
[2026-05-05 16:41:27 +0200] info [whostmgrd] 38.58.182.144 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.172.81.150
country_id: 1819730
description:
[2026-05-05 17:06:26 +0200] info [whostmgrd] 103.172.81.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.172.81.150
country_id: 1819730
description:
[2026-05-05 17:06:29 +0200] info [whostmgrd] 103.172.81.150 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.164.192
country_id: 1880251
description:
[2026-05-05 17:14:55 +0200] info [whostmgrd] 152.42.164.192 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 152.42.164.192
country_id: 1880251
description:
[2026-05-05 17:14:57 +0200] info [whostmgrd] 152.42.164.192 - root "GET /scripts2/doautocp HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.160.253.91
country_id: 1880251
description:
[2026-05-05 17:30:24 +0200] info [whostmgrd] 43.160.253.91 - root "GET /cpsess3774313801/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 43.160.253.91
country_id: 1880251
description:
[2026-05-05 17:30:24 +0200] info [whostmgrd] 43.160.253.91 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  5 17:40:42 india kernel: php-fpm[652835]: segfault at 7efeef0afdc6 ip 00007efefbb37777 sp 00007ffcb07bace8 error 4 in opcache.so[7efefbb00000+e4000]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 110.54.206.137
country_id: 1694008
description:
[2026-05-05 18:47:39 +0200] info [whostmgrd] 110.54.206.137 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.54.206.137
country_id: 1694008
description:
[2026-05-05 18:47:38 +0200] info [whostmgrd] 110.54.206.137 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.205.229.245
country_id: 2921044
description:
[2026-05-05 18:50:23 +0200] info [whostmgrd] 92.205.229.245 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 92.205.229.245
country_id: 2921044
description:
[2026-05-05 18:50:24 +0200] info [whostmgrd] 92.205.229.245 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.201
country_id: 1269750
description:
May  5 19:28:34 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.201.199.153
country_id: 1880251
description:
May  5 19:30:52 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.201.199.153 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  5 19:43:48 india kernel: php-fpm[669511]: segfault at 24000000100 ip 0000024000000100 sp 00007ffda4402c60 error 14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.106.246
country_id: 3469034
description:
May  5 19:59:01 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.106.246 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  5 20:01:41 india kernel: php-fpm[671878]: segfault at 7f3ab8d9f91e ip 00007f3ac5337777 sp 00007ffda43fe838 error 4 in opcache.so[7f3ac5300000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  5 20:19:47 india kernel: php-fpm[674362]: segfault at 7f3ab8d9f91e ip 00007f3ac5337777 sp 00007ffda43fe838 error 4 in opcache.so[7f3ac5300000+e4000]


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.19.216.146
country_id: 6252001
description:
37.19.216.146 - - [05/May/2026:20:35:03 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9619140&pdata=https%253A%252F%252Fcyberelite.in%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778006096 HTTP/2.0" 302 0 cyberelite.in "https://cyberelite.in:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.19.216.146


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.118.89
country_id: 6252001
description:
47.251.118.89 - - [05/May/2026:20:35:23 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9925010&pdata=https%253A%252F%252Famruttbhatt.com%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778006118 HTTP/2.0" 302 0 amruttbhatt.com "https://amruttbhatt.com:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.118.89


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.79.205
country_id: 6252001
description:
47.251.79.205 - - [05/May/2026:20:34:45 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10251370&pdata=https%253A%252F%252Fkeshvaeng.com%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778006082 HTTP/2.0" 302 0 keshvaeng.com "https://keshvaeng.com:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.79.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.89.134
country_id: 6252001
description:
47.251.89.134 - - [05/May/2026:20:34:46 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7248021&pdata=https%253A%252F%252Famrutdrumcircle.com%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778006083 HTTP/2.0" 302 0 amrutdrumcircle.com "https://amrutdrumcircle.com:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.89.134


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [05/May/2026:20:34:50 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6527429&pdata=https%253A%252F%252F156.67.111.41%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778006086 HTTP/2.0" 302 0 156.67.111.41 "https://156.67.111.41:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.246.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [05/May/2026:20:34:52 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9791849&pdata=https%253A%252F%252Fwww.amruttbhatt.com%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778006088 HTTP/2.0" 302 0 www.amruttbhatt.com "https://www.amruttbhatt.com:2096/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 130.94.42.64
country_id: 6252001
description:
[2026-05-05 21:21:11 +0200] info [whostmgrd] 130.94.42.64 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.94.42.64
country_id: 6252001
description:
[2026-05-05 21:21:10 +0200] info [whostmgrd] 130.94.42.64 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.115
country_id: 1269750
description:
May  5 21:56:29 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.115
country_id: 1269750
description:
May  5 21:56:36 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.49.80.154
country_id: 3469034
description:
May  5 22:46:14 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.49.80.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.49.80.154
country_id: 3469034
description:
2026-05-05 22:46:16 dovecot_plain authenticator failed for H=(6MB1PQ8V7O8RZW8) [179.49.80.154]:7597: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.150.164.225
country_id: 3585968
description:
May  5 22:53:32 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.150.164.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.150.164.225
country_id: 3585968
description:
2026-05-05 22:53:34 dovecot_plain authenticator failed for H=(Z69Q27X) [190.150.164.225]:59096: 535 Incorrect authentication data (set_id=palash@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.150.164.225
country_id: 3585968
description:
May  5 22:53:39 india auth[230219]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.150.164.225 has been locked due to Imunify RBL


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
May  6 00:15:31 india dovecot[711486]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.191.33
country_id: 6252001
description:
May  6 00:31:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.191.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-05-06 00:31:35 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (bogie) [73.0.191.33]:38922: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.82.240.46
country_id: 1643084
description:
May  6 00:44:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.82.240.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.248.183.8
country_id: 1831722
description:
[2026-05-06 00:48:36 +0200] info [whostmgrd] 124.248.183.8 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 124.248.183.8
country_id: 1831722
description:
[2026-05-06 00:48:40 +0200] info [whostmgrd] 124.248.183.8 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.220.111
country_id: 3469034
description:
May  6 01:01:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.220.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.194.88
country_id: 798544
description:
May  6 01:02:13 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.194.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.110.58
country_id: 798544
description:
May  6 01:33:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.110.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.110.58
country_id: 798544
description:
May  6 01:33:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.110.58 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 01:51:46 india kernel: php-fpm[726050]: segfault at 7f030064656c ip 00007f030064656c sp 00007ffedd1abb10 error 14


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 02:10:35 india kernel: php-fpm[728347]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a76e8 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 02:51:13 india kernel: php-fpm[736522]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a7a88 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 03:01:34 india kernel: php-fpm[737777]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a7a88 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.133
country_id: 3469034
description:
May  6 03:09:15 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.133
country_id: 3469034
description:
May  6 03:09:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.133 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 03:23:40 india kernel: php-fpm[740788]: segfault at 7f030064656c ip 00007f030064656c sp 00007ffedd1abb10 error 14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.246
country_id: 1269750
description:
May  6 03:34:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.246
country_id: 1269750
description:
May  6 03:34:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.71.228.54
country_id: 1269750
description:
May  6 03:51:52 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.71.228.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.228.54
country_id: 1269750
description:
2026-05-06 03:51:54 dovecot_plain authenticator failed for H=(polight) [167.71.228.54]:56656: 535 Incorrect authentication data (set_id=contact@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.57.54
country_id: 1269750
description:
May  6 03:56:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.57.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.54
country_id: 1269750
description:
2026-05-06 03:56:31 dovecot_plain authenticator failed for H=(quouser) [182.95.57.54]:33050: 535 Incorrect authentication data (set_id=cyberelite@cyberelite.in)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 04:04:46 india kernel: php-fpm[747165]: segfault at 7f030064656c ip 00007f030064656c sp 00007ffedd1abb10 error 14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.87.15
country_id: 3469034
description:
May  6 04:50:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.87.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.94.37.133
country_id: 6252001
description:
[2026-05-06 04:53:52 +0200] info [whostmgrd] 130.94.37.133 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 130.94.37.133
country_id: 6252001
description:
[2026-05-06 04:53:55 +0200] info [whostmgrd] 130.94.37.133 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 107.173.210.100
country_id: 6252001
description:
[2026-05-06 04:59:23 +0200] info [whostmgrd] 107.173.210.100 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.173.210.100
country_id: 6252001
description:
[2026-05-06 04:59:36 +0200] info [whostmgrd] 107.173.210.100 - root "GET /cpsess1198949684/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 65.0.118.16
country_id: 1269750
description:
[2026-05-06 05:05:00 +0200] info [whostmgrd] 65.0.118.16 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.0.118.16
country_id: 1269750
description:
[2026-05-06 05:05:00 +0200] info [whostmgrd] 65.0.118.16 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID hvmb88) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 05:09:47 india kernel: php-fpm[755631]: segfault at 7f030064656c ip 00007f030064656c sp 00007ffedd1abb10 error 14


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 05:11:27 india kernel: php-fpm[756002]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a7a88 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.136.236.213
country_id: 1605651
description:
[2026-05-06 05:20:50 +0200] info [cpaneld] 45.136.236.213 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN cpaneld: openid connect: 'cpaneld' provider 'cpanelid' encountered an error: (XID xtjvw5) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “cpaneld”.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 05:54:14 india kernel: php-fpm[761358]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a76e8 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 06:32:25 india kernel: php-fpm[766352]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a7458 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.98.11.169
country_id: 597427
description:
[2026-05-06 06:49:01 +0200] info [whostmgrd] 141.98.11.169 - root "GET /cpsess4251839349/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 141.98.11.169
country_id: 597427
description:
[2026-05-06 06:49:00 +0200] info [whostmgrd] 141.98.11.169 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.51.226.101
country_id: 3175395
description:
May  6 07:00:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.51.226.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.51.226.101
country_id: 3175395
description:
May  6 07:00:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.51.226.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.104.127.134
country_id: 1269750
description:
May  6 07:00:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.104.127.134 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 07:06:36 india kernel: php-fpm[770347]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a6338 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 87.121.84.136
country_id: 6252001
description:
[2026-05-06 07:07:22 +0200] info [whostmgrd] 87.121.84.136 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.84.136
country_id: 6252001
description:
[2026-05-06 07:07:21 +0200] info [whostmgrd] 87.121.84.136 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 07:07:39 +0200] info [whostmgrd] 87.121.84.167 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 07:07:42 +0200] info [whostmgrd] 87.121.84.167 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 07:09:32 india kernel: php-fpm[770796]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a76e8 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 07:13:32 india kernel: php-fpm[771378]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a76e8 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 07:37:29 india kernel: php-fpm[774197]: segfault at 7f030064656c ip 00007f030064656c sp 00007ffedd1abb10 error 14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.213.47.228
country_id: 1643084
description:
[2026-05-06 08:05:48 +0200] info [whostmgrd] 140.213.47.228 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 140.213.39.130
country_id: 1643084
description:
[2026-05-06 08:05:48 +0200] info [whostmgrd] 140.213.39.130 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [140.213.47.228] != Current IP Address [140.213.39.130]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 08:13:13 india kernel: php-fpm[778222]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a6338 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 08:14:59 +0200] info [whostmgrd] 87.121.84.167 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 08:14:57 +0200] info [whostmgrd] 87.121.84.167 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.213.47.228
country_id: 1643084
description:
[2026-05-06 08:15:57 +0200] info [whostmgrd] 140.213.47.228 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 140.213.39.130
country_id: 1643084
description:
[2026-05-06 08:15:59 +0200] info [whostmgrd] 140.213.39.130 - root "GET /scripts2/doautocp HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [140.213.47.228] != Current IP Address [140.213.39.130]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 08:20:05 +0200] info [whostmgrd] 87.121.84.167 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 08:20:07 +0200] info [whostmgrd] 87.121.84.167 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 08:31:19 +0200] info [whostmgrd] 87.121.84.167 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 08:31:20 +0200] info [whostmgrd] 87.121.84.167 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 08:48:32 india kernel: php-fpm[783922]: segfault at 7f030064656c ip 00007f030064656c sp 00007ffedd1abb10 error 14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.94.37.226
country_id: 6252001
description:
[2026-05-06 08:51:16 +0200] info [whostmgrd] 130.94.37.226 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 130.94.37.226
country_id: 6252001
description:
[2026-05-06 08:51:18 +0200] info [whostmgrd] 130.94.37.226 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.93.187.111
country_id: 6252001
description:
[2026-05-06 09:04:18 +0200] info [whostmgrd] 147.93.187.111 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 147.93.187.111
country_id: 6252001
description:
[2026-05-06 09:04:21 +0200] info [whostmgrd] 147.93.187.111 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.213.254.107
country_id: 1643084
description:
[2026-05-06 09:05:06 +0200] info [whostmgrd] 140.213.254.107 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 140.213.254.107
country_id: 1643084
description:
[2026-05-06 09:05:07 +0200] info [whostmgrd] 140.213.254.107 - root "GET /scripts2/doautocp HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 140.213.105.127
country_id: 1643084
description:
[2026-05-06 09:05:08 +0200] info [whostmgrd] 140.213.105.127 - root "GET /scripts2/top HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [140.213.254.107] != Current IP Address [140.213.105.127]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.213.105.127
country_id: 1643084
description:
[2026-05-06 09:14:15 +0200] info [whostmgrd] 140.213.105.127 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 140.213.254.107
country_id: 1643084
description:
[2026-05-06 09:14:16 +0200] info [whostmgrd] 140.213.254.107 - root "GET /scripts2/doautocp HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [140.213.105.127] != Current IP Address [140.213.254.107]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 09:15:25 india kernel: php-fpm[787028]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a6338 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 09:16:20 india kernel: php-fpm[787284]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a76e8 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 09:18:10 india kernel: php-fpm[787389]: segfault at 7f030064656c ip 00007f030064656c sp 00007ffedd1abb10 error 14


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 09:18:28 india kernel: php-fpm[787440]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a70d8 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.93.187.111
country_id: 6252001
description:
[2026-05-06 09:23:51 +0200] info [whostmgrd] 147.93.187.111 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 147.93.187.111
country_id: 6252001
description:
[2026-05-06 09:23:53 +0200] info [whostmgrd] 147.93.187.111 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.200.64.157
country_id: 1861060
description:
[2026-05-06 09:30:31 +0200] info [whostmgrd] 185.200.64.157 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.200.64.157
country_id: 1861060
description:
[2026-05-06 09:30:30 +0200] info [whostmgrd] 185.200.64.157 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 140.213.254.107
country_id: 1643084
description:
[2026-05-06 09:33:07 +0200] info [whostmgrd] 140.213.254.107 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [140.213.105.127] != Current IP Address [140.213.254.107]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.213.105.127
country_id: 1643084
description:
[2026-05-06 09:33:04 +0200] info [whostmgrd] 140.213.105.127 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 140.213.105.127
country_id: 1643084
description:
[2026-05-06 09:33:05 +0200] info [whostmgrd] 140.213.105.127 - root "GET /scripts2/doautocp HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 09:37:45 india kernel: php-fpm[789733]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a6f88 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 09:39:12 india kernel: php-fpm[789857]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a7078 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.88.86.81
country_id: 298795
description:
[2026-05-06 09:47:45 +0200] info [whostmgrd] 195.88.86.81 - admin\x{0d}\\nhasroot=1\x{0d}\x{0a}user=root "GET /json-api/whoami HTTP/1.1" FAILED LOGIN whostmgrd: user name not provided or invalid user


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 09:56:19 india kernel: php-fpm[791770]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a76e8 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 10:01:47 india kernel: php-fpm[792419]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a7a88 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.10.21.53
country_id: 6252001
description:
[2026-05-06 10:07:07 +0200] info [webmaild] 34.10.21.53 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: root login is not permitted to webmaild


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.179.91.227
country_id: 1269750
description:
[2026-05-06 10:29:10 +0200] info [cpaneld] 122.179.91.227 - easytra "GET /cpsess7989315269/frontend/jupiter/wp-toolkit/index.live.php HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [122.179.88.122] != Current IP Address [122.179.91.227]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 10:28:52 india kernel: php-fpm[796108]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a7a88 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 122.179.91.227
country_id: 1269750
description:
[2026-05-06 10:29:15 +0200] info [cpaneld] 122.179.91.227 NEW easytra:EVJzYzowtSolWKg9 address=122.179.91.227,app=cpaneld,creator=easytra,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 10:32:32 india kernel: php-fpm[797239]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a7a88 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 10:33:37 india kernel: php-fpm[797740]: segfault at 7f039b78d8ee ip 00007f03a8f37777 sp 00007ffedd1a7a88 error 4 in opcache.so[7f03a8f00000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.156
country_id: 953987
description:
May  6 10:42:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.101
country_id: 1269750
description:
May  6 10:42:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.156
country_id: 953987
description:
May  6 10:42:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.156 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.205.80.20
country_id: 1269750
description:
[2026-05-06 10:47:28 +0200] info [whostmgrd] 106.205.80.20 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 194.233.76.224
country_id: 1880251
description:
[2026-05-06 12:34:29 +0200] info [whostmgrd] 194.233.76.224 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.233.76.224
country_id: 1880251
description:
[2026-05-06 12:34:27 +0200] info [whostmgrd] 194.233.76.224 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.233.76.224
country_id: 1880251
description:
[2026-05-06 12:34:30 +0200] info [whostmgrd] 194.233.76.224 - root "GET /cpsess8501142251/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 13:29:01 +0200] info [whostmgrd] 87.121.84.167 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 13:29:02 +0200] info [whostmgrd] 87.121.84.167 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 13:59:14 +0200] info [whostmgrd] 87.121.84.167 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.121.84.167
country_id: 6252001
description:
[2026-05-06 13:59:13 +0200] info [whostmgrd] 87.121.84.167 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 38.54.71.114
country_id: 1282988
description:
[2026-05-06 14:38:48 +0200] info [whostmgrd] 38.54.71.114 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.54.71.114
country_id: 1282988
description:
[2026-05-06 14:38:46 +0200] info [whostmgrd] 38.54.71.114 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.68
country_id: 2510769
description:
May  6 15:00:04 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.120.50
country_id: 1269750
description:
May  6 15:04:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.120.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2026-05-06 15:04:13 dovecot_plain authenticator failed for H=(kupbult) [182.95.120.50]:48832: 535 Incorrect authentication data (set_id=career@cyberelite.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.233.76.224
country_id: 1880251
description:
[2026-05-06 15:06:48 +0200] info [whostmgrd] 194.233.76.224 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID vw7adu) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 194.233.76.224
country_id: 1880251
description:
[2026-05-06 15:06:53 +0200] info [whostmgrd] 194.233.76.224 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.21.225.5
country_id: 3865483
description:
May  6 15:55:06 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.21.225.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.21.225.5
country_id: 3865483
description:
2026-05-06 15:55:08 dovecot_plain authenticator failed for H=(GXA8DC) [181.21.225.5]:61711: 535 Incorrect authentication data (set_id=company@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.188.22.212
country_id: 357994
description:
2026-05-06 16:07:58 dovecot_plain authenticator failed for H=(5HJ30XO6291) [102.188.22.212]:51788: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.63.162.157
country_id: 6252001
description:
2026-05-06 16:21:34 dovecot_plain authenticator failed for H=c-73-63-162-157.hsd1.ca.comcast.net (nostakelum) [73.63.162.157]:50026: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.63.162.157
country_id: 6252001
description:
May  6 16:21:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.63.162.157 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:29:21 india sshd[853926]: Accepted publickey for root from 106.205.80.20 port 57304 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:29:35 india sshd[854012]: Accepted publickey for root from 106.205.80.20 port 57311 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:30:49 india sshd[854622]: Accepted publickey for root from 106.205.80.20 port 57351 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:32:03 india sshd[854821]: Accepted publickey for root from 106.205.80.20 port 57392 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:32:51 india sshd[854970]: Accepted publickey for root from 106.205.80.20 port 57414 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:33:43 india sshd[855228]: Accepted publickey for root from 106.205.80.20 port 57442 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:34:39 india sshd[855505]: Accepted publickey for root from 106.205.80.20 port 57479 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:35:33 india sshd[855793]: Accepted publickey for root from 106.205.80.20 port 57508 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:36:40 india sshd[856193]: Accepted publickey for root from 106.205.80.20 port 57549 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:37:49 india sshd[856483]: Accepted publickey for root from 106.205.80.20 port 57590 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:38:44 india sshd[856756]: Accepted publickey for root from 106.205.80.20 port 57636 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:39:53 india sshd[857060]: Accepted publickey for root from 106.205.80.20 port 57695 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:41:45 india sshd[857496]: Accepted publickey for root from 106.205.80.20 port 57757 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:42:43 india sshd[857697]: Accepted publickey for root from 106.205.80.20 port 57802 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 16:44:26 india sshd[857981]: Accepted publickey for root from 106.205.80.20 port 57861 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 17:13:38 india sshd[863137]: Accepted publickey for root from 106.205.80.20 port 59277 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 17:15:02 india sshd[863803]: Accepted publickey for root from 106.205.80.20 port 59321 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 17:15:38 india sshd[865510]: Accepted publickey for root from 106.205.80.20 port 59340 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  6 17:16:34 india sshd[865683]: Accepted publickey for root from 106.205.80.20 port 59372 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
May  6 17:19:38 india sshd[866423]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 17:30:16 india kernel: php-fpm[881931]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.122
country_id: 1269750
description:
2026-05-06 17:29:50 dovecot_plain authenticator failed for H=(parte) [128.185.220.122]:56708: 535 Incorrect authentication data (set_id=contact@cyberelite.in)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 17:37:23 india kernel: php-fpm[882847]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
country_id: 290557
description:
May  6 17:39:19 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-05-06 17:39:21 dovecot_plain authenticator failed for H=(pospon) [5.32.22.218]:42606: 535 Incorrect authentication data (set_id=career@cyberelite.in)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 17:45:16 india kernel: php-fpm[883929]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 17:48:00 india sshd[884184]: Accepted publickey for root from 103.84.70.112 port 59696 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 17:48:33 india sshd[884322]: Accepted publickey for root from 103.84.70.112 port 59717 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 17:56:59 india sshd[894072]: Accepted publickey for root from 103.84.70.112 port 60116 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 17:57:35 india sshd[894268]: Accepted publickey for root from 103.84.70.112 port 60141 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 18:00:15 india kernel: php-fpm[894861]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 17:59:56 india sshd[894639]: Accepted publickey for root from 103.84.70.112 port 60289 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 18:01:00 india sshd[894933]: Accepted publickey for root from 103.84.70.112 port 60329 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 18:01:36 india sshd[895168]: Accepted publickey for root from 103.84.70.112 port 60348 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 18:02:35 india sshd[895430]: Accepted publickey for root from 103.84.70.112 port 60382 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 18:03:50 india sshd[895827]: Accepted publickey for root from 103.84.70.112 port 60428 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 18:05:04 india sshd[896165]: Accepted publickey for root from 103.84.70.112 port 60466 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 18:05:42 india sshd[896395]: Accepted publickey for root from 103.84.70.112 port 60491 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 18:06:49 india sshd[896559]: Accepted publickey for root from 103.84.70.112 port 60533 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 18:08:07 india sshd[896898]: Accepted publickey for root from 103.84.70.112 port 60579 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 18:08:36 india sshd[897033]: Accepted publickey for root from 103.84.70.112 port 60599 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  6 18:09:31 india sshd[897288]: Accepted publickey for root from 103.84.70.112 port 60638 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 18:15:16 india kernel: php-fpm[898667]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 18:30:15 india kernel: php-fpm[900499]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 18:45:15 india kernel: php-fpm[902394]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 19:00:18 india kernel: php-fpm[904190]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May  6 19:04:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May  6 19:04:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.130
country_id: 3175395
description:
May  6 19:09:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.10.93
country_id: 3469034
description:
May  6 19:10:06 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.10.93 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 19:14:11 india kernel: php-fpm[906167]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 19:15:17 india kernel: php-fpm[906412]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.173.210.100
country_id: 6252001
description:
[2026-05-06 19:16:12 +0200] info [webmaild] 107.173.210.100 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN webmaild: openid connect: 'webmaild' provider 'cpanelid' encountered an error: (XID xur8rq) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “webmaild”.


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 19:30:15 india kernel: php-fpm[908231]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 19:45:16 india kernel: php-fpm[910086]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 20:00:15 india kernel: php-fpm[911882]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 20:15:15 india kernel: php-fpm[914184]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 20:30:19 india kernel: php-fpm[916055]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 20:31:30 india kernel: php-fpm[916187]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 20:45:15 india kernel: php-fpm[917897]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 20:51:31 india kernel: php-fpm[918677]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 21:00:14 india kernel: php-fpm[919812]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.254
country_id: 3469034
description:
May  6 21:04:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.8.254
country_id: 3469034
description:
May  6 21:04:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.8.254 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
May  6 21:06:28 india sshd[920608]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 21:15:18 india kernel: php-fpm[921932]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.133.80.147
country_id: 298795
description:
[2026-05-06 21:15:59 +0200] info [whostmgrd] 24.133.80.147 - m3l0z0tk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 24.133.80.147
country_id: 298795
description:
[2026-05-06 21:16:02 +0200] info [whostmgrd] 24.133.80.147 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 21:30:15 india kernel: php-fpm[923892]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 21:40:53 india kernel: php-fpm[925264]: segfault at 7fab2df0b5be ip 00007fab3a937777 sp 00007ffe0a47a938 error 4 in opcache.so[7fab3a900000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 21:45:16 india kernel: php-fpm[925868]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 22:00:17 india kernel: php-fpm[927699]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 22:15:16 india kernel: php-fpm[929898]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 22:24:21 india kernel: php-fpm[930747]: segfault at 7fab2df0b5be ip 00007fab3a937777 sp 00007ffe0a47a938 error 4 in opcache.so[7fab3a900000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 22:30:15 india kernel: php-fpm[931530]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 22:45:16 india kernel: php-fpm[933283]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 23:00:16 india kernel: php-fpm[934896]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 23:03:31 india kernel: php-fpm[935177]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 23:07:08 india kernel: php-fpm[935731]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 23:15:16 india kernel: php-fpm[936841]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 23:30:16 india kernel: php-fpm[938662]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.215.14.162
country_id: 6252001
description:
[2026-05-06 23:42:38 +0200] info [cpaneld] 162.215.14.162 - cybereli "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cybereli (has_cpuser_file failed)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  6 23:45:15 india kernel: php-fpm[940663]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  7 00:00:17 india kernel: php-fpm[942498]: segfault at 10040 ip 0000000000010040 sp 00007ffe0a47edb0 error 14 in php-fpm[400000+4ad000]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.169.4.238
country_id: 2635167
description:
2026-05-07 00:04:03 H=([185.169.4.238]) [185.169.4.238]:58250 F=<dpr@priv8shop.com> rejected RCPT <monjane2024@outlook.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.117.2
country_id: 226074
description:
May  7 02:23:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.117.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.81.133.199
country_id: 6252001
description:
[2026-05-07 02:50:16 +0200] info [whostmgrd] 172.81.133.199 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID rkbneb) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 172.81.133.199
country_id: 6252001
description:
[2026-05-07 02:50:20 +0200] info [whostmgrd] 172.81.133.199 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.120.179.228
country_id: 1269750
description:
[2026-05-07 05:16:45 +0200] info [whostmgrd] 103.120.179.228 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.89.160.224
country_id: 2635167
description:
[2026-05-07 05:33:32 +0200] info [whostmgrd] 64.89.160.224 - u92f46a7959 "GET /cpsess7331352433/ HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to whm by a non-reseller/root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.212.10
country_id: 798544
description:
May  7 05:42:04 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.212.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.173.210.100
country_id: 6252001
description:
[2026-05-07 05:52:42 +0200] info [whostmgrd] 107.173.210.100 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID qnzt8q) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 107.173.210.100
country_id: 6252001
description:
[2026-05-07 05:52:46 +0200] info [whostmgrd] 107.173.210.100 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:35:48 india sshd[1008974]: Accepted publickey for root from 106.205.80.20 port 63014 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:36:32 india sshd[1009208]: Accepted publickey for root from 106.205.80.20 port 63049 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:38:47 india sshd[1009632]: Accepted publickey for root from 106.205.80.20 port 63152 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:40:32 india sshd[1010179]: Accepted publickey for root from 106.205.80.20 port 63247 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:41:44 india sshd[1010666]: Accepted publickey for root from 106.205.80.20 port 63292 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:42:50 india sshd[1011206]: Accepted publickey for root from 106.205.80.20 port 63333 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:44:04 india sshd[1011507]: Accepted publickey for root from 106.205.80.20 port 63375 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:44:43 india sshd[1011805]: Accepted publickey for root from 106.205.80.20 port 63397 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:47:04 india sshd[1012573]: Accepted publickey for root from 106.205.80.20 port 63477 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:47:31 india sshd[1012717]: Accepted publickey for root from 106.205.80.20 port 63492 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:48:37 india sshd[1013243]: Accepted publickey for root from 106.205.80.20 port 63533 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:49:32 india sshd[1018510]: Accepted publickey for root from 106.205.80.20 port 63566 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:51:30 india sshd[1019449]: Accepted publickey for root from 106.205.80.20 port 63633 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  7 06:53:16 india kernel: php-fpm[1019960]: segfault at 7f6d80cc70b6 ip 00007f6d8df37777 sp 00007ffcbeb427a8 error 4 in opcache.so[7f6d8df00000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.248.38.196
country_id: 1269750
description:
May  7 06:55:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.248.38.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.248.38.196
country_id: 1269750
description:
2026-05-07 06:55:07 dovecot_plain authenticator failed for H=(E1261D68V5UP6) [161.248.38.196]:21239: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:55:17 india sshd[1020358]: Accepted publickey for root from 106.205.80.20 port 63773 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:57:20 india sshd[1020648]: Accepted publickey for root from 106.205.80.20 port 63834 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  7 06:58:17 india kernel: php-fpm[1020927]: segfault at 7f6d80cc70b6 ip 00007f6d8df37777 sp 00007ffcbeb427a8 error 4 in opcache.so[7f6d8df00000+e4000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:57:57 india sshd[1020755]: Accepted publickey for root from 106.205.80.20 port 63855 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:58:31 india sshd[1021032]: Accepted publickey for root from 106.205.80.20 port 63871 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 06:59:39 india sshd[1021245]: Accepted publickey for root from 106.205.80.20 port 63912 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 07:00:38 india sshd[1021837]: Accepted publickey for root from 106.205.80.20 port 63966 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 07:01:36 india sshd[1022266]: Accepted publickey for root from 106.205.80.20 port 64000 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  7 07:06:45 india kernel: php-fpm[1023217]: segfault at 7f6d80cc70b6 ip 00007f6d8df37777 sp 00007ffcbeb427a8 error 4 in opcache.so[7f6d8df00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  7 07:08:28 india kernel: php-fpm[1023391]: segfault at 7f6d80cc70b6 ip 00007f6d8df37777 sp 00007ffcbeb427a8 error 4 in opcache.so[7f6d8df00000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.85.63.58
country_id: 3469034
description:
May  7 07:30:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.85.63.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.250.228.92
country_id: 1880251
description:
[2026-05-07 08:12:33 +0200] info [whostmgrd] 192.250.228.92 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 192.250.228.92
country_id: 1880251
description:
[2026-05-07 08:12:33 +0200] info [whostmgrd] 192.250.228.92 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 122.179.91.227
country_id: 1269750
description:
[2026-05-07 08:50:33 +0200] info [cpaneld] 122.179.91.227 NEW bechomaxx:H_u19whHJTklQAQA address=122.179.91.227,app=cpaneld,creator=bechomaxx,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.90
country_id: 3469034
description:
May  7 09:01:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.117
country_id: 3175395
description:
May  7 09:30:38 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.107.77.179
country_id: 2921044
description:
May  7 09:53:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 86.107.77.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 49.43.3.18
country_id: 1269750
description:
[2026-05-07 10:35:31 +0200] info [cpaneld] 49.43.3.18 - ce "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [49.43.3.35] != Current IP Address [49.43.3.18]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 49.43.3.18
country_id: 1269750
description:
[2026-05-07 10:35:34 +0200] info [cpaneld] 49.43.3.18 NEW ce:5iQVbPyXbNyDaoZ9 address=49.43.3.18,app=cpaneld,creator=ce,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:22:23 india sshd[1063057]: Accepted publickey for root from 106.205.80.20 port 64251 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:22:47 india sshd[1063172]: Accepted publickey for root from 106.205.80.20 port 64266 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:27:20 india sshd[1064182]: Accepted publickey for root from 106.205.80.20 port 64443 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:27:59 india sshd[1064333]: Accepted publickey for root from 106.205.80.20 port 64463 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:29:02 india sshd[1064530]: Accepted publickey for root from 106.205.80.20 port 64498 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:29:40 india sshd[1064706]: Accepted publickey for root from 106.205.80.20 port 64524 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:30:49 india sshd[1065035]: Accepted publickey for root from 106.205.80.20 port 64560 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:31:39 india sshd[1065269]: Accepted publickey for root from 106.205.80.20 port 64592 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:33:06 india sshd[1065718]: Accepted publickey for root from 106.205.80.20 port 64645 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.68.104.72
country_id: 3017382
description:
[2026-05-07 11:33:39 +0200] info [whostmgrd] 164.68.104.72 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 164.68.104.72
country_id: 3017382
description:
[2026-05-07 11:33:40 +0200] info [whostmgrd] 164.68.104.72 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:33:55 india sshd[1065905]: Accepted publickey for root from 106.205.80.20 port 64671 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:34:53 india sshd[1066027]: Accepted publickey for root from 106.205.80.20 port 64709 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:35:38 india sshd[1066421]: Accepted publickey for root from 106.205.80.20 port 64735 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:36:47 india sshd[1066676]: Accepted publickey for root from 106.205.80.20 port 64772 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:37:33 india sshd[1066837]: Accepted publickey for root from 106.205.80.20 port 64792 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:38:34 india sshd[1067023]: Accepted publickey for root from 106.205.80.20 port 64833 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:39:37 india sshd[1067409]: Accepted publickey for root from 106.205.80.20 port 64867 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:40:33 india sshd[1067850]: Accepted publickey for root from 106.205.80.20 port 64902 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:41:47 india sshd[1068243]: Accepted publickey for root from 106.205.80.20 port 64953 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:42:37 india sshd[1068472]: Accepted publickey for root from 106.205.80.20 port 64979 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:43:50 india sshd[1069880]: Accepted publickey for root from 106.205.80.20 port 65024 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:44:50 india sshd[1070006]: Accepted publickey for root from 106.205.80.20 port 65058 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:45:47 india sshd[1070435]: Accepted publickey for root from 106.205.80.20 port 65090 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 11:46:32 india sshd[1070731]: Accepted publickey for root from 106.205.80.20 port 65120 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.132.186
country_id: 1269750
description:
May  7 12:25:08 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.132.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 188.166.212.28
country_id: 1880251
description:
[2026-05-07 13:51:08 +0200] info [whostmgrd] 188.166.212.28 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.166.212.28
country_id: 1880251
description:
[2026-05-07 13:51:07 +0200] info [whostmgrd] 188.166.212.28 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 106.205.80.20
country_id: 1269750
description:
May  7 14:02:11 india sshd[1090799]: Accepted publickey for root from 106.205.80.20 port 49242 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.245.54.115
country_id: 6252001
description:
[2026-05-07 14:12:25 +0200] info [cpaneld] 83.245.54.115 - cyberelite "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cyberelite (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.76.16.124
country_id: 6252001
description:
[2026-05-07 14:12:02 +0200] info [cpaneld] 153.76.16.124 - Support@cyberelite.in "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.76.22.61
country_id: 6252001
description:
[2026-05-07 14:12:13 +0200] info [cpaneld] 153.76.22.61 - cybereli "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cybereli (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 153.76.19.123
country_id: 6252001
description:
[2026-05-07 14:12:33 +0200] info [cpaneld] 153.76.19.123 - cyberelitein "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cyberelitein (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.170
country_id: 1269750
description:
May  7 14:17:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.170 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  7 16:37:11 india sshd[1114130]: Accepted publickey for root from 103.84.70.112 port 51447 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  7 16:44:22 india sshd[1115278]: Accepted publickey for root from 103.84.70.112 port 51763 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  7 16:44:37 india sshd[1115360]: Accepted publickey for root from 103.84.70.112 port 51776 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May  7 16:45:48 india sshd[1115787]: Accepted publickey for root from 103.84.70.112 port 51830 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.84.70.112
country_id: 1269750
description:
[2026-05-07 16:47:33 +0200] info [whostmgrd] 103.84.70.112 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.205.80.20] != Current IP Address [103.84.70.112]


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 103.84.70.112
country_id: 1269750
description:
[2026-05-07 16:47:33 +0200] info [whostmgrd] 103.84.70.112 PURGE root:dZrzTvmCOL_UL_EC badpass [cookie ip check: IP address has changed: IP Address [106.205.80.20] != Current IP Address [103.84.70.112]]


plugin: ossec
rule: 11009
name: WHM login success
abuser: 103.84.70.112
country_id: 1269750
description:
[2026-05-07 16:47:42 +0200] info [whostmgrd] 103.84.70.112 NEW root:BHrG2lNPrnwUQae5 address=103.84.70.112,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.60.194.108
country_id: 2963597
description:
May  7 17:13:13 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.60.194.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.179
country_id: 2300660
description:
May  7 17:13:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.226.33.123
country_id: 3865483
description:
May  7 18:03:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.226.33.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.66.113
country_id: 1269750
description:
May  7 18:04:12 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.66.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.169.4.16
country_id: 2635167
description:
2026-05-07 18:19:09 H=([185.169.4.16]) [185.169.4.16]:54475 F=<dpr@priv8shop.com> rejected RCPT <sirpeter4all@hotmail.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.71.161.52
country_id: 1643084
description:
[2026-05-07 18:22:24 +0200] info [whostmgrd] 103.71.161.52 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.71.161.52
country_id: 1643084
description:
[2026-05-07 18:22:25 +0200] info [whostmgrd] 103.71.161.52 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.201
country_id: 3469034
description:
May  7 18:30:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.201
country_id: 3469034
description:
May  7 18:30:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.142
country_id: 3469034
description:
May  7 18:30:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.142 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  7 18:49:14 india kernel: php-fpm[1139346]: segfault at 7f8d768f400e ip 00007f8d83d37777 sp 00007ffd96901cf8 error 4 in opcache.so[7f8d83d00000+e4000]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 49.43.5.217
country_id: 1269750
description:
[2026-05-07 18:49:53 +0200] info [cpaneld] 49.43.5.217 NEW ce:NKbq4ZIWkDdSdHgF address=49.43.5.217,app=cpaneld,creator=ce,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  7 18:51:02 india kernel: php-fpm[1139683]: segfault at 7f8d768f400e ip 00007f8d83d37777 sp 00007ffd96901cf8 error 4 in opcache.so[7f8d83d00000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  7 19:00:02 india kernel: php-fpm[1142145]: segfault at 7f8d768f400e ip 00007f8d83d37777 sp 00007ffd969016e8 error 4 in opcache.so[7f8d83d00000+e4000]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.145.84.10
country_id: 6252001
description:
2026-05-07 19:05:02 dovecot_plain authenticator failed for H=(mail.local) [107.145.84.10]:59669: 535 Incorrect authentication data (set_id=reachout@amruttbhatt.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.209.103.67
country_id: 6252001
description:
2026-05-07 19:05:01 dovecot_plain authenticator failed for H=(mail.local) [47.209.103.67]:45729: 535 Incorrect authentication data (set_id=eachout@amruttbhatt.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.149.25
country_id: 2921044
description:
May  7 20:13:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.112.79.150
country_id: 1643084
description:
May  7 20:25:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.112.79.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.149.25
country_id: 2921044
description:
May  7 20:37:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.60
country_id: 1210997
description:
2026-05-07 21:26:10 dovecot_login authenticator failed for H=([72.207.113.126]) [103.115.252.60]:33276: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.8
country_id: 3175395
description:
May  7 21:45:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.219
country_id: 3175395
description:
May  7 21:45:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.102
country_id: 1269750
description:
May  7 22:39:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.166.49
country_id: 1819730
description:
[2026-05-07 23:48:12 +0200] info [whostmgrd] 104.28.166.49 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.166.49
country_id: 1819730
description:
[2026-05-07 23:48:13 +0200] info [whostmgrd] 104.28.166.49 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May  7 23:49:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May  7 23:49:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.35.40
country_id: 1269750
description:
May  7 23:50:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.35.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.192.67.43
country_id: 3077311
description:
May  8 00:45:14 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.192.67.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.131
country_id: 933860
description:
May  8 00:45:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.154.200
country_id: 3017382
description:
[2026-05-08 00:45:56 +0200] info [cpaneld] 104.28.154.200 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.164.192
country_id: 1880251
description:
[2026-05-08 02:39:26 +0200] info [whostmgrd] 152.42.164.192 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 152.42.164.192
country_id: 1880251
description:
[2026-05-08 02:39:28 +0200] info [whostmgrd] 152.42.164.192 - root "GET /scripts2/doautocp HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.164.192
country_id: 1880251
description:
[2026-05-08 02:39:33 +0200] info [whostmgrd] 152.42.164.192 - root "GET /cpsess8056720784/json-api/loadavg?api.version=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 152.42.164.192
country_id: 1880251
description:
[2026-05-08 02:39:30 +0200] info [whostmgrd] 152.42.164.192 - root "GET /scripts3/initial_setup_wizard1 HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.216.104.190
country_id: 3469034
description:
May  8 03:26:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.216.104.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.108
country_id: 3175395
description:
May  8 03:27:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.108
country_id: 3175395
description:
May  8 03:27:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.98
country_id: 1269750
description:
May  8 04:25:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.91
country_id: 3175395
description:
May  8 05:08:53 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.248
country_id: 953987
description:
May  8 05:09:13 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.248
country_id: 953987
description:
May  8 05:09:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.26.72.158
country_id: 1861060
description:
[2026-05-08 05:34:20 +0200] info [whostmgrd] 82.26.72.158 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID wv3n3n) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.26.72.158
country_id: 1861060
description:
[2026-05-08 05:34:21 +0200] info [whostmgrd] 82.26.72.158 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 82.26.72.158
country_id: 1861060
description:
[2026-05-08 05:34:23 +0200] info [whostmgrd] 82.26.72.158 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.147
country_id: 3469034
description:
May  8 06:13:00 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.231.34
country_id: 1269750
description:
2026-05-08 07:14:35 dovecot_plain authenticator failed for H=(noses) [182.95.231.34]:56746: 535 Incorrect authentication data (set_id=career@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.231.34
country_id: 1269750
description:
May  8 07:14:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.231.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.241
country_id: 690791
description:
2026-05-08 08:34:54 H=([77.83.39.241]) [77.83.39.241]:64592 F=<dpr@priv8shop.com> rejected RCPT <peterpan510@rocketmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.72.15
country_id: 1269750
description:
May  8 08:58:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.72.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.72.15
country_id: 1269750
description:
2026-05-08 08:58:13 dovecot_plain authenticator failed for H=(pousia) [122.165.72.15]:53765: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.234.125.45
country_id: 798544
description:
May  8 10:00:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.234.125.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 49.43.5.217
country_id: 1269750
description:
[2026-05-08 11:03:04 +0200] info [cpaneld] 49.43.5.217 NEW ce:b9YXd9y3yNo6b3RB address=49.43.5.217,app=cpaneld,creator=ce,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.92.23.157
country_id: 2542007
description:
[2026-05-08 11:08:27 +0200] info [whostmgrd] 41.92.23.157 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 41.92.54.38
country_id: 2542007
description:
[2026-05-08 11:08:28 +0200] info [whostmgrd] 41.92.54.38 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [41.92.23.157] != Current IP Address [41.92.54.38]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 49.43.3.144
country_id: 1269750
description:
[2026-05-08 13:06:29 +0200] info [cpaneld] 49.43.3.144 NEW ce:d3IUCf6XqPwR80N6 address=49.43.3.144,app=cpaneld,creator=ce,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 49.43.3.144
country_id: 1269750
description:
[2026-05-08 13:06:22 +0200] info [cpaneld] 49.43.3.144 - ce "GET /cpsess8112117646/json-api/cpanel?cpanel_jsonapi_module=Fileman&cpanel_jsonapi_func=listfiles&cpanel_jsonapi_apiversion=2&needmime=1&dir=%2fhome%2fce%2fpublic_html%2fwp-content%2fplugins%2feligibility-modal-widget&showdotfiles=1&cache_fix=1778238382129 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [49.43.3.18] != Current IP Address [49.43.3.144]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.95
country_id: 2635167
description:
2026-05-08 14:19:52 H=([64.89.160.95]) [64.89.160.95]:51708 F=<dpr@priv8shop.com> rejected RCPT <johndocument1@gmail.com>: Sender verify failed


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.156.230
country_id: 1269750
description:
May  8 14:30:25 india sshd[1298984]: Accepted publickey for root from 171.60.156.230 port 58722 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.156.230
country_id: 1269750
description:
May  8 14:31:36 india sshd[1299302]: Accepted publickey for root from 171.60.156.230 port 58775 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.156.230
country_id: 1269750
description:
May  8 14:32:22 india sshd[1299664]: Accepted publickey for root from 171.60.156.230 port 58807 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.156.230
country_id: 1269750
description:
May  8 14:33:50 india sshd[1300044]: Accepted publickey for root from 171.60.156.230 port 58864 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.156.230
country_id: 1269750
description:
May  8 14:34:53 india sshd[1300313]: Accepted publickey for root from 171.60.156.230 port 58903 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.156.230
country_id: 1269750
description:
May  8 14:35:44 india sshd[1300787]: Accepted publickey for root from 171.60.156.230 port 58932 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.156.230
country_id: 1269750
description:
May  8 14:37:30 india sshd[1301070]: Accepted publickey for root from 171.60.156.230 port 58990 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.156.230
country_id: 1269750
description:
May  8 14:46:05 india sshd[1302236]: Accepted publickey for root from 171.60.156.230 port 59277 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.156.230
country_id: 1269750
description:
May  8 14:46:26 india sshd[1302415]: Accepted publickey for root from 171.60.156.230 port 59302 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.156.230
country_id: 1269750
description:
May  8 14:47:27 india sshd[1302750]: Accepted publickey for root from 171.60.156.230 port 59347 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 171.60.156.230
country_id: 1269750
description:
[2026-05-08 14:48:08 +0200] info [cpaneld] 171.60.156.230 - keshvaeng "GET /cpsess9740274725/xfercpanel/bechomaxx HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [103.84.70.112] != Current IP Address [171.60.156.230]


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 171.60.156.230
country_id: 1269750
description:
[2026-05-08 14:48:14 +0200] info [whostmgrd] 171.60.156.230 PURGE root:BHrG2lNPrnwUQae5 badpass [cookie ip check: IP address has changed: IP Address [103.84.70.112] != Current IP Address [171.60.156.230]]


plugin: ossec
rule: 11009
name: WHM login success
abuser: 171.60.156.230
country_id: 1269750
description:
[2026-05-08 14:48:17 +0200] info [whostmgrd] 171.60.156.230 NEW root:pQtt7NkBPCcBlcpA address=171.60.156.230,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.91.217.213
country_id: 6252001
description:
[2026-05-08 14:50:26 +0200] info [whostmgrd] 98.91.217.213 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 98.91.217.213
country_id: 6252001
description:
[2026-05-08 14:50:28 +0200] info [whostmgrd] 98.91.217.213 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.69.102
country_id: 1269750
description:
May  8 14:51:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.69.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.69.102
country_id: 1269750
description:
2026-05-08 14:51:34 dovecot_plain authenticator failed for H=(trinderma) [182.78.69.102]:56324: 535 Incorrect authentication data (set_id=contact@cyberelite.in)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 43.207.88.171
country_id: 1861060
description:
[2026-05-08 14:52:52 +0200] info [whostmgrd] 43.207.88.171 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.207.88.171
country_id: 1861060
description:
[2026-05-08 14:52:51 +0200] info [whostmgrd] 43.207.88.171 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.144.246.79
country_id: 6252001
description:
[2026-05-08 14:56:51 +0200] info [whostmgrd] 18.144.246.79 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 18.144.246.79
country_id: 6252001
description:
[2026-05-08 14:56:53 +0200] info [whostmgrd] 18.144.246.79 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 146.190.105.14
country_id: 1880251
description:
[2026-05-08 15:12:41 +0200] info [whostmgrd] 146.190.105.14 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.105.14
country_id: 1880251
description:
[2026-05-08 15:12:40 +0200] info [whostmgrd] 146.190.105.14 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.207.88.171
country_id: 1861060
description:
[2026-05-08 15:29:27 +0200] info [whostmgrd] 43.207.88.171 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 43.207.88.171
country_id: 1861060
description:
[2026-05-08 15:29:28 +0200] info [whostmgrd] 43.207.88.171 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.144.246.79
country_id: 6252001
description:
[2026-05-08 15:34:14 +0200] info [whostmgrd] 18.144.246.79 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 18.144.246.79
country_id: 6252001
description:
[2026-05-08 15:34:16 +0200] info [whostmgrd] 18.144.246.79 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.137.85
country_id: 690791
description:
May  8 16:44:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.137.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.198.128.204
country_id: 1835841
description:
May  8 17:39:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.198.128.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
country_id: 3996063
description:
May  8 17:39:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
country_id: 6252001
description:
May  8 17:40:56 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.35.192.98
country_id: 1814991
description:
May  8 17:41:02 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.35.192.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
May  8 17:40:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.168
country_id: 3175395
description:
May  8 17:42:26 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May  8 18:51:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 49.43.5.217
country_id: 1269750
description:
[2026-05-08 18:57:31 +0200] info [cpaneld] 49.43.5.217 - ce "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 49.43.5.217
country_id: 1269750
description:
[2026-05-08 18:57:39 +0200] info [cpaneld] 49.43.5.217 NEW ce:c3k3IePhB3hI1Nx9 address=49.43.5.217,app=cpaneld,creator=ce,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.57.248.81
country_id: 1819730
description:
[2026-05-08 19:01:30 +0200] info [whostmgrd] 103.57.248.81 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID ewgnwh) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.57.248.81
country_id: 1819730
description:
[2026-05-08 19:01:38 +0200] info [whostmgrd] 103.57.248.81 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-05-08 19:11:45 dovecot_plain authenticator failed for H=(undedly) [65.20.143.159]:59002: 535 Incorrect authentication data (set_id=hostmaster@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.143.159
country_id: 99237
description:
May  8 19:11:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-05-08 19:11:52 dovecot_plain authenticator failed for H=(rabae) [109.226.27.227]:58899: 535 Incorrect authentication data (set_id=hostmaster@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.53.165.212
country_id: 3469034
description:
May  8 19:13:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.53.165.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.161.8
country_id: 2635167
description:
2026-05-08 19:35:10 H=([64.89.161.8]) [64.89.161.8]:58031 F=<dpr@priv8shop.com> rejected RCPT <mainjayjah@protonmail.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 49.43.3.144
country_id: 1269750
description:
[2026-05-08 19:36:51 +0200] info [cpaneld] 49.43.3.144 - ce "GET / HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 49.43.3.144
country_id: 1269750
description:
[2026-05-08 19:36:54 +0200] info [cpaneld] 49.43.3.144 NEW ce:zTX2Ncapc_au7EL7 address=49.43.3.144,app=cpaneld,creator=ce,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.227.227
country_id: 6252001
description:
47.77.227.227 - - [08/May/2026:20:19:15 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12895946&pdata=https%253A%252F%252Feasytravelsworld.com%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778264351 HTTP/2.0" 302 0 easytravelsworld.com "https://easytravelsworld.com:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.227.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [08/May/2026:20:19:47 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050343&pdata=https%253A%252F%252Fkeshvaeng.com%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778264382 HTTP/2.0" 302 0 keshvaeng.com "https://keshvaeng.com:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.254.76.66
country_id: 6252001
description:
47.254.76.66 - - [08/May/2026:20:19:52 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9740231&pdata=https%253A%252F%252Find1.cyberelite.org%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778264388 HTTP/2.0" 302 0 ind1.cyberelite.org "https://ind1.cyberelite.org:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.254.76.66


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.118.89
country_id: 6252001
description:
47.251.118.89 - - [08/May/2026:20:19:55 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10130379&pdata=https%253A%252F%252Fcyberelite.in%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778264386 HTTP/2.0" 302 0 cyberelite.in "https://cyberelite.in:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.118.89


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  8 21:18:20 india kernel: php-fpm[1350218]: segfault at 7f4e89d7f7c6 ip 00007f4e96537777 sp 00007ffeabc0cd58 error 4 in opcache.so[7f4e96500000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  8 21:19:26 india kernel: php-fpm[1350261]: segfault at 7f4e89d7f7c6 ip 00007f4e96537777 sp 00007ffeabc0cd58 error 4 in opcache.so[7f4e96500000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  8 21:20:24 india kernel: php-fpm[1350402]: segfault at 7f4e89d7f7c6 ip 00007f4e96537777 sp 00007ffeabc0cd58 error 4 in opcache.so[7f4e96500000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May  8 21:21:31 india kernel: php-fpm[1350662]: segfault at 7f4e89d7f7c6 ip 00007f4e96537777 sp 00007ffeabc0cd58 error 4 in opcache.so[7f4e96500000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.183.202
country_id: 3469034
description:
May  8 22:37:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.183.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.241
country_id: 690791
description:
2026-05-08 23:30:06 H=([77.83.39.241]) [77.83.39.241]:59517 F=<dpr@priv8shop.com> rejected RCPT <peterpan510@rocketmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.252.50.89
country_id: 1269750
description:
May  9 00:17:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.252.50.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.143.188
country_id: 1269750
description:
May  9 00:19:24 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.143.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.100.84
country_id: 1269750
description:
May  9 00:20:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.100.84 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.166.49
country_id: 1819730
description:
[2026-05-09 00:29:22 +0200] info [whostmgrd] 104.28.166.49 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.166.49
country_id: 1819730
description:
[2026-05-09 00:29:23 +0200] info [whostmgrd] 104.28.166.49 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.154.196
country_id: 1269750
description:
May  9 00:40:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.154.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.126
country_id: 3175395
description:
May  9 00:40:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.76.184.8
country_id: 732800
description:
May  9 00:40:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.76.184.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.51
country_id: 3469034
description:
May  9 00:41:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.94.8.3
country_id: 587116
description:
[2026-05-09 02:12:44 +0200] info [whostmgrd] 172.94.8.3 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID 57nc6p) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 172.94.8.3
country_id: 587116
description:
[2026-05-09 02:12:47 +0200] info [whostmgrd] 172.94.8.3 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.240
country_id: 953987
description:
May  9 02:59:00 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.240 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.220.146
country_id: 6252001
description:
47.77.220.146 - - [09/May/2026:04:16:17 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6647955&pdata=http%253A%252F%252Feasytravelsworld.com%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778292974 HTTP/1.1" 302 0 easytravelsworld.com "http://easytravelsworld.com:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.220.146


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [09/May/2026:04:17:03 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13328791&pdata=http%253A%252F%252Find1.cyberelite.org%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778293017 HTTP/1.1" 302 0 ind1.cyberelite.org "http://ind1.cyberelite.org:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.254.76.66
country_id: 6252001
description:
47.254.76.66 - - [09/May/2026:04:16:37 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6394519&pdata=http%253A%252F%252Find2.cyberelite.org%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778292992 HTTP/1.1" 302 0 ind2.cyberelite.org "http://ind2.cyberelite.org:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.254.76.66


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May  9 04:20:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.86.122.176
country_id: 3017382
description:
[2026-05-09 04:46:58 +0200] info [whostmgrd] 167.86.122.176 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 167.86.122.176
country_id: 3017382
description:
[2026-05-09 04:46:59 +0200] info [whostmgrd] 167.86.122.176 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.224.62
country_id: 1269750
description:
May  9 05:05:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.224.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2026-05-09 05:05:37 dovecot_plain authenticator failed for H=(lantry) [182.95.224.62]:60688: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.235
country_id: 798544
description:
May  9 05:30:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.235 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [09/May/2026:05:39:48 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9934790&pdata=http%253A%252F%252Fwww.amruttbhatt.com%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778297983 HTTP/1.1" 302 0 www.amruttbhatt.com "http://www.amruttbhatt.com:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.246.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.228.238
country_id: 6252001
description:
47.77.228.238 - - [09/May/2026:05:40:12 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13133931&pdata=http%253A%252F%252Findia.myserverlogin.in%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778298009 HTTP/1.1" 302 0 india.myserverlogin.in "http://india.myserverlogin.in:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.228.238


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.60
country_id: 690791
description:
May  9 05:40:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.70
country_id: 3865483
description:
May  9 05:40:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.146.238.122
country_id: 2542007
description:
May  9 07:01:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.146.238.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-05-09 07:01:42 dovecot_plain authenticator failed for H=(symprean) [154.146.238.122]:38222: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.254
country_id: 3469034
description:
May  9 07:31:19 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.254
country_id: 3469034
description:
May  9 07:31:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.246
country_id: 3469034
description:
May  9 07:32:02 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.42
country_id: 3175395
description:
May  9 07:32:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.116
country_id: 2963597
description:
May  9 09:26:09 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.146
country_id: 99237
description:
May  9 09:27:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.143.116
country_id: 2963597
description:
May  9 09:26:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.143.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.180.178
country_id: 1269750
description:
2026-05-09 10:47:09 dovecot_plain authenticator failed for H=(stoebers) [182.95.180.178]:50010: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.180.178
country_id: 1269750
description:
May  9 10:47:07 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.180.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.203
country_id: 298795
description:
May  9 11:21:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.203
country_id: 298795
description:
May  9 11:21:24 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.92
country_id: 798544
description:
May  9 11:21:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.92 has been locked due to Imunify RBL


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 122.179.90.143
country_id: 1269750
description:
[2026-05-09 11:34:22 +0200] info [cpaneld] 122.179.90.143 NEW bechomaxx:NBuZk_RUiQ6PcG2q address=122.179.90.143,app=cpaneld,creator=bechomaxx,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.60.158.60
country_id: 2921044
description:
[2026-05-09 12:30:12 +0200] info [whostmgrd] 62.60.158.60 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.39
country_id: 3469034
description:
May  9 13:24:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.115
country_id: 3175395
description:
May  9 13:31:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.61
country_id: 1269750
description:
May  9 14:08:00 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.92.241.10
country_id: 2750405
description:
[2026-05-09 14:55:04 +0200] info [whostmgrd] 91.92.241.10 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 91.92.241.10
country_id: 2750405
description:
[2026-05-09 14:55:05 +0200] info [whostmgrd] 91.92.241.10 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.47.10.172
country_id: 1269750
description:
[2026-05-09 16:05:29 +0200] info [cpaneld] 49.47.10.172 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.47.10.172
country_id: 1269750
description:
[2026-05-09 16:06:31 +0200] info [cpaneld] 49.47.10.172 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.149.88
country_id: 294640
description:
May  9 16:19:16 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.149.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2026-05-09 16:19:18 dovecot_plain authenticator failed for H=(unpred) [82.102.149.88]:35591: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.85
country_id: 732800
description:
May  9 18:14:13 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.85
country_id: 732800
description:
May  9 18:14:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.161.8
country_id: 2635167
description:
2026-05-09 18:22:03 H=([64.89.161.8]) [64.89.161.8]:63730 F=<dpr@priv8shop.com> rejected RCPT <mainjayjah@outlook.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.140.187
country_id: 3175395
description:
May  9 18:36:02 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.140.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
country_id: 2542007
description:
May  9 18:44:12 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-05-09 18:44:14 dovecot_plain authenticator failed for H=(snereou) [102.53.15.18]:53450: 535 Incorrect authentication data (set_id=career@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.40
country_id: 3469034
description:
May  9 19:09:14 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.40
country_id: 3469034
description:
May  9 19:09:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.28.14
country_id: 6252001
description:
2026-05-09 19:56:52 dovecot_plain authenticator failed for H=c-73-21-28-14.hsd1.ga.comcast.net (bromes) [73.21.28.14]:48644: 535 Incorrect authentication data (set_id=career@cyberelite.in)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.117
country_id: 690791
description:
2026-05-09 21:43:49 H=([77.83.39.117]) [77.83.39.117]:62210 F=<dpr@priv8shop.com> rejected RCPT <peterpan510@rocketmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.206.214
country_id: 953987
description:
May  9 22:44:07 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.206.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.125
country_id: 953987
description:
May  9 22:46:01 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May  9 23:16:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.226
country_id: 3469034
description:
May  9 23:18:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.88.96.233
country_id: 2635167
description:
[2026-05-10 01:17:39 +0200] info [whostmgrd] 194.88.96.233 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 194.88.96.233
country_id: 2635167
description:
[2026-05-10 01:17:40 +0200] info [whostmgrd] 194.88.96.233 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.129.19.250
country_id: 1643084
description:
2026-05-10 01:44:21 dovecot_login authenticator failed for H=(vePARF) [114.129.19.250]:40744: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.91
country_id: 3175395
description:
May 10 03:10:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.102
country_id: 953987
description:
May 10 03:11:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.156.78
country_id: 690791
description:
May 10 03:11:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.156.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.181
country_id: 3469034
description:
May 10 03:34:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.207.94
country_id: 1269750
description:
May 10 03:34:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.207.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.181
country_id: 3469034
description:
May 10 03:34:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.166
country_id: 2395170
description:
May 10 03:34:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.207.94
country_id: 1269750
description:
2026-05-10 03:34:27 dovecot_plain authenticator failed for H=(rings) [125.19.207.94]:45960: 535 Incorrect authentication data (set_id=admin@cyberelite.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-05-10 03:38:00 +0200] info [cpaneld] 128.199.123.37 - cybereli "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cybereli (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.162.132
country_id: 2186224
description:
May 10 03:39:14 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.162.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.132
country_id: 2186224
description:
2026-05-10 03:39:16 dovecot_login authenticator failed for H=([103.168.241.32]) [121.73.162.132]:35504: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.43
country_id: 690791
description:
2026-05-10 04:12:49 H=([45.144.212.43]) [45.144.212.43]:58365 F=<dpr@priv8shop.com> rejected RCPT <garyconsultant@outlook.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.166
country_id: 2395170
description:
May 10 03:34:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.102
country_id: 953987
description:
May 10 03:11:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.88.96.233
country_id: 2635167
description:
[2026-05-10 01:17:41 +0200] info [whostmgrd] 194.88.96.233 - root "GET /cpsess7375234381/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.156.78
country_id: 690791
description:
May 10 03:11:52 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.156.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.91
country_id: 3175395
description:
May 10 03:10:52 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.199.123.37
country_id: 1880251
description:
[2026-05-10 03:38:01 +0200] info [cpaneld] 128.199.123.37 - cyberelitein "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cyberelitein (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.81.130
country_id: 1269750
description:
May 10 05:25:10 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.81.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.81.130
country_id: 1269750
description:
May 10 05:25:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.81.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.227.214.33
country_id: 1835841
description:
May 10 05:59:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.227.214.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
country_id: 1835841
description:
2026-05-10 05:59:22 dovecot_login authenticator failed for H=([222.120.176.6]) [182.227.214.33]:59364: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.119.99.82
country_id: 1831722
description:
[2026-05-10 06:09:25 +0200] info [whostmgrd] 103.119.99.82 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.119.99.82
country_id: 1831722
description:
[2026-05-10 06:09:23 +0200] info [whostmgrd] 103.119.99.82 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.28.53.18
country_id: 690791
description:
May 10 06:11:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.28.53.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 143.110.227.93
country_id: 6252001
description:
[2026-05-10 06:19:39 +0200] info [whostmgrd] 143.110.227.93 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [209.38.159.63] != Current IP Address [143.110.227.93]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.38.159.63
country_id: 6252001
description:
[2026-05-10 06:19:38 +0200] info [whostmgrd] 209.38.159.63 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.118.224.138
country_id: 1835841
description:
May 10 06:24:52 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.118.224.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-05-10 06:24:54 dovecot_login authenticator failed for H=([120.211.5.35]) [210.118.224.138]:50318: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.211.5.35
country_id: 1814991
description:
May 10 06:47:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.211.5.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.211.5.35
country_id: 1814991
description:
2026-05-10 06:47:57 dovecot_login authenticator failed for H=([174.64.199.87]) [120.211.5.35]:47686: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
country_id: 1814991
description:
May 10 06:48:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2026-05-10 06:48:45 dovecot_login authenticator failed for H=(ip32-147-111-78.pppoe.ivanovo.stream.ru) [118.183.180.108]:10159: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.1.105.10
country_id: 1733045
description:
May 10 07:10:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.1.105.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.1.105.10
country_id: 1733045
description:
2026-05-10 07:10:53 dovecot_login authenticator failed for H=(KCTjZcM) [103.1.105.10]:47552: 535 Incorrect authentication data (set_id=namit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.195.31
country_id: 3865483
description:
May 10 07:13:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.195.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.27.46
country_id: 226074
description:
May 10 07:14:18 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.27.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.27.46
country_id: 226074
description:
May 10 07:14:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.27.46 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [10/May/2026:07:27:09 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6910304&pdata=https%253A%252F%252Find2.cyberelite.org%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778390822 HTTP/2.0" 302 0 ind2.cyberelite.org "https://ind2.cyberelite.org:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.18.245
country_id: 6252001
description:
47.88.18.245 - - [10/May/2026:07:27:27 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7368040&pdata=https%253A%252F%252Fcyberelite.in%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778390841 HTTP/2.0" 302 0 cyberelite.in "https://cyberelite.in:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.18.245


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.209.252.178
country_id: 1269750
description:
May 10 08:15:37 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.209.252.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.209.252.178
country_id: 1269750
description:
2026-05-10 08:15:39 dovecot_login authenticator failed for H=([182.95.181.22]) [154.209.252.178]:37128: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
country_id: 1814991
description:
May 10 08:22:07 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2026-05-10 08:22:09 dovecot_login authenticator failed for H=([182.95.27.67]) [118.183.180.108]:56347: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 10 08:53:00 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.18.40.214
country_id: 2635167
description:
May 10 09:52:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.18.40.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.18.40.214
country_id: 2635167
description:
2026-05-10 09:52:29 dovecot_login authenticator failed for H=([208.69.161.214]) [82.18.40.214]:35132: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.210.189.159
country_id: 3277605
description:
May 10 10:23:53 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.210.189.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-05-10 10:40:19 dovecot_login authenticator failed for H=([125.20.76.121]) [207.188.158.216]:14532: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.58.70.69
country_id: 3686110
description:
May 10 10:44:16 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.58.70.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.58.70.69
country_id: 3686110
description:
2026-05-10 10:44:18 dovecot_plain authenticator failed for H=(dingol) [181.58.70.69]:50270: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-05-10 11:40:18 dovecot_login authenticator failed for H=(ip-213-124-221-2.ip.prioritytelecom.net) [27.123.111.110]:54988: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.89.72
country_id: 1835841
description:
May 10 11:40:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.89.72
country_id: 1835841
description:
2026-05-10 11:40:53 dovecot_login authenticator failed for H=([125.221.160.14]) [106.246.89.72]:45209: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.179.90.143
country_id: 1269750
description:
[2026-05-10 12:12:12 +0200] info [cpaneld] 122.179.90.143 - Havishia_admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Havishia_admin (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 122.179.90.143
country_id: 1269750
description:
[2026-05-10 12:12:17 +0200] info [cpaneld] 122.179.90.143 NEW havishia:njeZOqSMXwZuvU8A address=122.179.90.143,app=cpaneld,creator=havishia,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.117
country_id: 690791
description:
2026-05-10 13:10:32 H=([77.83.39.117]) [77.83.39.117]:54535 F=<dpr@priv8shop.com> rejected RCPT <peterpan510@rocketmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.248.76.43
country_id: 2363686
description:
May 10 13:12:12 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.248.76.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.248.76.43
country_id: 2363686
description:
May 10 13:12:26 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.248.76.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.84.1.105
country_id: 3469034
description:
May 10 13:59:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.84.1.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.238
country_id: 3175395
description:
May 10 14:24:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.201
country_id: 3865483
description:
May 10 15:19:19 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.201
country_id: 3865483
description:
May 10 15:19:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.201 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.222.219.216
country_id: 1269750
description:
[2026-05-10 17:49:07 +0200] info [cpaneld] 106.222.219.216 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.222.219.216
country_id: 1269750
description:
[2026-05-10 17:49:22 +0200] info [cpaneld] 106.222.219.216 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:02:35 india sshd[1678520]: Accepted publickey for root from 103.84.70.112 port 63549 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:04:42 india sshd[1678977]: Accepted publickey for root from 103.84.70.112 port 63677 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:05:28 india sshd[1679278]: Accepted publickey for root from 103.84.70.112 port 63705 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:06:22 india sshd[1679515]: Accepted publickey for root from 103.84.70.112 port 63736 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:10:57 india sshd[1680186]: Accepted publickey for root from 103.84.70.112 port 63927 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:11:30 india sshd[1680338]: Accepted publickey for root from 103.84.70.112 port 63946 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:12:40 india sshd[1680898]: Accepted publickey for root from 103.84.70.112 port 63987 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:13:21 india sshd[1681126]: Accepted publickey for root from 103.84.70.112 port 64028 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.165
country_id: 3175395
description:
May 10 18:16:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.165 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:23:24 india sshd[1682619]: Accepted publickey for root from 103.84.70.112 port 64407 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:24:31 india sshd[1682900]: Accepted publickey for root from 103.84.70.112 port 64443 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:27:19 india sshd[1683418]: Accepted publickey for root from 103.84.70.112 port 64549 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:27:26 india sshd[1683475]: Accepted publickey for root from 103.84.70.112 port 64552 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 10 18:28:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:31:09 india sshd[1684334]: Accepted publickey for root from 103.84.70.112 port 64696 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:31:27 india sshd[1684452]: Accepted publickey for root from 103.84.70.112 port 64709 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.168.93.75
country_id: 6252001
description:
2026-05-10 18:31:56 H=([127.0.0.1]) [104.168.93.75]:56644 F=<dpr@priv8shop.com> rejected RCPT <smtpf0x@lotuswritingservices.com>: Sender verify failed


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:32:37 india sshd[1684674]: Accepted publickey for root from 103.84.70.112 port 64762 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:33:23 india sshd[1684969]: Accepted publickey for root from 103.84.70.112 port 64796 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 49.43.5.217
country_id: 1269750
description:
[2026-05-10 18:34:05 +0200] info [cpaneld] 49.43.5.217 NEW ce:EYQINwD7xuEsK_tc address=49.43.5.217,app=cpaneld,creator=ce,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:34:46 india sshd[1685378]: Accepted publickey for root from 103.84.70.112 port 64868 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:35:24 india sshd[1685806]: Accepted publickey for root from 103.84.70.112 port 64895 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:36:20 india sshd[1686320]: Accepted publickey for root from 103.84.70.112 port 65027 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:37:39 india sshd[1686860]: Accepted publickey for root from 103.84.70.112 port 65136 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:38:21 india sshd[1687087]: Accepted publickey for root from 103.84.70.112 port 65241 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:44:19 india sshd[1687919]: Accepted publickey for root from 103.84.70.112 port 65468 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:44:22 india sshd[1687980]: Accepted publickey for root from 103.84.70.112 port 65469 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:45:57 india sshd[1688620]: Accepted publickey for root from 103.84.70.112 port 49155 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:46:44 india sshd[1688773]: Accepted publickey for root from 103.84.70.112 port 49181 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:47:43 india sshd[1688993]: Accepted publickey for root from 103.84.70.112 port 49219 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:48:31 india sshd[1689320]: Accepted publickey for root from 103.84.70.112 port 49247 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:49:24 india sshd[1689659]: Accepted publickey for root from 103.84.70.112 port 49279 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:51:17 india sshd[1690005]: Accepted publickey for root from 103.84.70.112 port 49346 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:51:29 india sshd[1690113]: Accepted publickey for root from 103.84.70.112 port 49354 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:52:35 india sshd[1690335]: Accepted publickey for root from 103.84.70.112 port 49396 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.185.214.101
country_id: 6252001
description:
[2026-05-10 18:53:10 +0200] info [cpaneld] 71.185.214.101 - dronomaticaviati "GET /execute/DomainInfo/list_domains HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:53:39 india sshd[1690624]: Accepted publickey for root from 103.84.70.112 port 49432 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:54:58 india sshd[1691127]: Accepted publickey for root from 103.84.70.112 port 49483 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:55:25 india sshd[1691399]: Accepted publickey for root from 103.84.70.112 port 49503 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:56:25 india sshd[1691671]: Accepted publickey for root from 103.84.70.112 port 49553 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:57:32 india sshd[1692122]: Accepted publickey for root from 103.84.70.112 port 49604 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:58:44 india sshd[1692365]: Accepted publickey for root from 103.84.70.112 port 49642 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 18:59:21 india sshd[1692614]: Accepted publickey for root from 103.84.70.112 port 49670 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.133.83
country_id: 1269750
description:
May 10 18:59:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.133.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.208.176.0
country_id: 2635167
description:
[2026-05-10 18:59:51 +0200] info [cpaneld] 46.208.176.0 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:01:23 india sshd[1693258]: Accepted publickey for root from 103.84.70.112 port 49745 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:03:32 india sshd[1693743]: Accepted publickey for root from 103.84.70.112 port 49823 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:04:22 india sshd[1693963]: Accepted publickey for root from 103.84.70.112 port 49852 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:07:32 india sshd[1694479]: Accepted publickey for root from 103.84.70.112 port 50017 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.30.141.164
country_id: 3865483
description:
[2026-05-10 19:14:35 +0200] info [cpaneld] 190.30.141.164 - dronomaticaviati "GET /:2083:2083/execute/DomainInfo/list_domains HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.15.155.93
country_id: 6252001
description:
[2026-05-10 19:23:00 +0200] info [cpaneld] 73.15.155.93 - dronomaticaviati "GET /:2083:2083:2083/execute/DomainInfo/list_domains HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.25.186.130
country_id: 6252001
description:
May 10 19:25:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.25.186.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-05-10 19:25:33 dovecot_login authenticator failed for H=(red.179.63.55.122.fastfiber.com.ar) [173.25.186.130]:50255: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.182.164.24
country_id: 2802361
description:
[2026-05-10 19:25:38 +0200] info [cpaneld] 95.182.164.24 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.4.191.80
country_id: 2635167
description:
[2026-05-10 19:26:20 +0200] info [cpaneld] 82.4.191.80 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.233.85.157
country_id: 6252001
description:
[2026-05-10 19:27:16 +0200] info [cpaneld] 67.233.85.157 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.165.109.11
country_id: 290557
description:
[2026-05-10 19:28:03 +0200] info [cpaneld] 217.165.109.11 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.152.31.129
country_id: 6252001
description:
[2026-05-10 19:27:46 +0200] info [cpaneld] 47.152.31.129 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.56.113.185
country_id: 6252001
description:
[2026-05-10 19:27:54 +0200] info [cpaneld] 98.56.113.185 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.205.12.252
country_id: 290557
description:
[2026-05-10 19:28:53 +0200] info [cpaneld] 176.205.12.252 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.87.217.194
country_id: 953987
description:
[2026-05-10 19:30:16 +0200] info [cpaneld] 197.87.217.194 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.18.190.112
country_id: 2017370
description:
[2026-05-10 19:30:19 +0200] info [cpaneld] 188.18.190.112 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.253.190.176
country_id: 1643084
description:
[2026-05-10 19:30:39 +0200] info [cpaneld] 180.253.190.176 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.55.121.34
country_id: 1814991
description:
[2026-05-10 19:30:39 +0200] info [cpaneld] 119.55.121.34 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.209.221.133
country_id: 2287781
description:
[2026-05-10 19:30:59 +0200] info [cpaneld] 102.209.221.133 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.181.223.173
country_id: 6251999
description:
[2026-05-10 19:31:06 +0200] info [cpaneld] 142.181.223.173 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.120.79.211
country_id: 298795
description:
[2026-05-10 19:31:15 +0200] info [cpaneld] 94.120.79.211 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.97.140.40
country_id: 3865483
description:
[2026-05-10 19:31:52 +0200] info [cpaneld] 191.97.140.40 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.76.88
country_id: 3895114
description:
[2026-05-10 19:32:38 +0200] info [cpaneld] 179.60.76.88 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:47:56 india sshd[1699607]: Accepted publickey for root from 103.84.70.112 port 51547 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:49:01 india sshd[1699906]: Accepted publickey for root from 103.84.70.112 port 51590 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:49:52 india sshd[1700212]: Accepted publickey for root from 103.84.70.112 port 51619 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:51:29 india sshd[1700531]: Accepted publickey for root from 103.84.70.112 port 51677 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:53:00 india sshd[1700755]: Accepted publickey for root from 103.84.70.112 port 51727 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:53:33 india sshd[1700890]: Accepted publickey for root from 103.84.70.112 port 51748 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:54:49 india sshd[1701236]: Accepted publickey for root from 103.84.70.112 port 51792 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:55:58 india sshd[1701494]: Accepted publickey for root from 103.84.70.112 port 51828 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:56:30 india sshd[1701634]: Accepted publickey for root from 103.84.70.112 port 51846 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:57:56 india sshd[1701946]: Accepted publickey for root from 103.84.70.112 port 51898 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 19:59:21 india sshd[1702116]: Accepted publickey for root from 103.84.70.112 port 51957 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:01:08 india sshd[1702567]: Accepted publickey for root from 103.84.70.112 port 52012 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:02:02 india sshd[1702765]: Accepted publickey for root from 103.84.70.112 port 52043 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:02:23 india sshd[1702893]: Accepted publickey for root from 103.84.70.112 port 52054 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:05:39 india sshd[1703509]: Accepted publickey for root from 103.84.70.112 port 52175 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:06:37 india sshd[1703978]: Accepted publickey for root from 103.84.70.112 port 52208 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:07:33 india sshd[1704242]: Accepted publickey for root from 103.84.70.112 port 52240 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:08:25 india sshd[1704446]: Accepted publickey for root from 103.84.70.112 port 52270 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:09:59 india sshd[1704783]: Accepted publickey for root from 103.84.70.112 port 52319 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:13:45 india sshd[1705451]: Accepted publickey for root from 103.84.70.112 port 52392 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:32:18 india sshd[1707792]: Accepted publickey for root from 103.84.70.112 port 52634 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:32:33 india sshd[1707868]: Accepted publickey for root from 103.84.70.112 port 52650 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:33:47 india sshd[1708283]: Accepted publickey for root from 103.84.70.112 port 52692 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:34:23 india sshd[1708454]: Accepted publickey for root from 103.84.70.112 port 52715 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:35:43 india sshd[1708862]: Accepted publickey for root from 103.84.70.112 port 52759 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:36:23 india sshd[1709282]: Accepted publickey for root from 103.84.70.112 port 52782 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:37:29 india sshd[1709753]: Accepted publickey for root from 103.84.70.112 port 52845 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:39:12 india sshd[1710189]: Accepted publickey for root from 103.84.70.112 port 52898 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:39:27 india sshd[1710258]: Accepted publickey for root from 103.84.70.112 port 52919 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:40:33 india sshd[1710646]: Accepted publickey for root from 103.84.70.112 port 52963 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:41:22 india sshd[1711217]: Accepted publickey for root from 103.84.70.112 port 52995 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:43:11 india sshd[1711699]: Accepted publickey for root from 103.84.70.112 port 53057 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:43:27 india sshd[1711781]: Accepted publickey for root from 103.84.70.112 port 53066 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:45:36 india sshd[1712265]: Accepted publickey for root from 103.84.70.112 port 53136 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.128
country_id: 1668284
description:
2026-05-10 20:45:38 dovecot_login authenticator failed for H=([78.37.9.103]) [101.13.4.128]:43408: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.37.74.212
country_id: 6251999
description:
2026-05-10 20:46:08 dovecot_login authenticator failed for H=modemcable212.74-37-24.static.videotron.ca ([14.34.85.99]) [24.37.74.212]:59912: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:46:36 india sshd[1712485]: Accepted publickey for root from 103.84.70.112 port 53170 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:48:07 india sshd[1712861]: Accepted publickey for root from 103.84.70.112 port 53223 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:48:53 india sshd[1712956]: Accepted publickey for root from 103.84.70.112 port 53259 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:50:05 india sshd[1713302]: Accepted publickey for root from 103.84.70.112 port 53292 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:50:38 india sshd[1713562]: Accepted publickey for root from 103.84.70.112 port 53320 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:51:25 india sshd[1713932]: Accepted publickey for root from 103.84.70.112 port 53347 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:52:38 india sshd[1714236]: Accepted publickey for root from 103.84.70.112 port 53387 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:53:25 india sshd[1714484]: Accepted publickey for root from 103.84.70.112 port 53417 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 20:54:33 india sshd[1714814]: Accepted publickey for root from 103.84.70.112 port 53455 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:00:31 india sshd[1715777]: Accepted publickey for root from 103.84.70.112 port 53680 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:02:31 india sshd[1716071]: Accepted publickey for root from 103.84.70.112 port 53741 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:04:24 india sshd[1716424]: Accepted publickey for root from 103.84.70.112 port 53800 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-05-10 21:05:18 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [45.82.109.136]:50684: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2026-05-10 21:05:44 dovecot_login authenticator failed for H=(karuna.divineled.com) [177.174.95.245]:51032: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.183.42
country_id: 1269750
description:
May 10 21:05:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.183.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.183.42
country_id: 1269750
description:
2026-05-10 21:05:59 dovecot_plain authenticator failed for H=(unremity) [182.95.183.42]:44546: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.95.245
country_id: 3469034
description:
May 10 21:05:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.95.245 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 10 21:08:06 india kernel: php-fpm[1716830]: segfault at 257b948 ip 000000000257b948 sp 00007ffeffa71150 error 15 in zero (deleted)[1c00000+20000000]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.200.60
country_id: 6252001
description:
[2026-05-10 21:14:36 +0200] info [whostmgrd] 134.199.200.60 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 134.199.200.60
country_id: 6252001
description:
[2026-05-10 21:14:37 +0200] info [whostmgrd] 134.199.200.60 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.129.228
country_id: 690791
description:
May 10 21:24:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.129.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.181
country_id: 3469034
description:
May 10 21:24:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.181 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 10 21:27:59 india kernel: php-fpm[1719206]: segfault at 257b948 ip 000000000257b948 sp 00007ffeffa71150 error 15 in zero (deleted)[1c00000+20000000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 10 21:28:22 india kernel: php-fpm[1719365]: segfault at 257b948 ip 000000000257b948 sp 00007ffeffa71150 error 15 in zero (deleted)[1c00000+20000000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 10 21:29:21 india kernel: php-fpm[1719459]: segfault at 257b948 ip 000000000257b948 sp 00007ffeffa71150 error 15 in zero (deleted)[1c00000+20000000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:29:58 india sshd[1719523]: Accepted publickey for root from 103.84.70.112 port 54665 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 10 21:30:39 india kernel: php-fpm[1719722]: segfault at 257b948 ip 000000000257b948 sp 00007ffeffa71150 error 15 in zero (deleted)[1c00000+20000000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:30:38 india sshd[1719955]: Accepted publickey for root from 103.84.70.112 port 54690 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 10 21:31:48 india kernel: php-fpm[1720226]: segfault at 257b948 ip 000000000257b948 sp 00007ffeffa71150 error 15 in zero (deleted)[1c00000+20000000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:31:45 india sshd[1720166]: Accepted publickey for root from 103.84.70.112 port 54731 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 10 21:32:52 india kernel: php-fpm[1720455]: segfault at 257b948 ip 000000000257b948 sp 00007ffeffa71150 error 15 in zero (deleted)[1c00000+20000000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:32:41 india sshd[1720384]: Accepted publickey for root from 103.84.70.112 port 54760 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 10 21:33:22 india kernel: php-fpm[1720616]: segfault at 257b948 ip 000000000257b948 sp 00007ffeffa71150 error 15 in zero (deleted)[1c00000+20000000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:33:44 india sshd[1720653]: Accepted publickey for root from 103.84.70.112 port 54793 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 10 21:34:25 india kernel: php-fpm[1720877]: segfault at 257b948 ip 000000000257b948 sp 00007ffeffa71150 error 15 in zero (deleted)[1c00000+20000000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:34:34 india sshd[1720905]: Accepted publickey for root from 103.84.70.112 port 54824 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 10 21:35:55 india kernel: php-fpm[1721238]: segfault at 257b948 ip 000000000257b948 sp 00007ffeffa71150 error 15 in zero (deleted)[1c00000+20000000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:36:00 india sshd[1721245]: Accepted publickey for root from 103.84.70.112 port 54869 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 10 21:36:22 india kernel: php-fpm[1721401]: segfault at 257b948 ip 000000000257b948 sp 00007ffeffa71150 error 15 in zero (deleted)[1c00000+20000000]


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:36:40 india sshd[1721421]: Accepted publickey for root from 103.84.70.112 port 54892 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:37:25 india sshd[1721773]: Accepted publickey for root from 103.84.70.112 port 54914 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:38:22 india sshd[1721972]: Accepted publickey for root from 103.84.70.112 port 54954 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 103.84.70.112
country_id: 1269750
description:
May 10 21:39:51 india sshd[1722296]: Accepted publickey for root from 103.84.70.112 port 55016 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 85.245.60.223
country_id: 2264397
description:
[2026-05-10 22:11:26 +0200] info [whostmgrd] 85.245.60.223 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.245.60.223
country_id: 2264397
description:
[2026-05-10 22:11:25 +0200] info [whostmgrd] 85.245.60.223 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.46.42.64
country_id: 2635167
description:
[2026-05-10 22:21:42 +0200] info [cpaneld] 80.46.42.64 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.21.60.146
country_id: 2635167
description:
[2026-05-10 22:21:47 +0200] info [cpaneld] 92.21.60.146 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.156.35.169
country_id: 2635167
description:
[2026-05-10 22:21:53 +0200] info [cpaneld] 81.156.35.169 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.0.114.195
country_id: 2017370
description:
[2026-05-10 22:21:57 +0200] info [cpaneld] 46.0.114.195 - dronomaticaviati "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.1
country_id: 798544
description:
May 10 22:37:16 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.133.20
country_id: 1269750
description:
May 10 22:36:58 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.133.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.1
country_id: 798544
description:
May 10 22:37:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.239.182
country_id: 1269750
description:
May 10 22:48:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.239.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-05-10 22:48:52 dovecot_login authenticator failed for H=([46.44.32.144]) [128.185.239.182]:56866: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.237
country_id: 130758
description:
May 10 23:14:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.49
country_id: 130758
description:
May 10 23:15:06 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.65
country_id: 130758
description:
May 10 23:21:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.177.179.40
country_id: 1668284
description:
May 10 23:24:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.177.179.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.94
country_id: 130758
description:
May 10 23:28:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.237
country_id: 130758
description:
May 10 23:32:12 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.49
country_id: 130758
description:
May 10 23:32:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 194.9.14.99
country_id: 690791
description:
[2026-05-10 23:42:18 +0200] info [whostmgrd] 194.9.14.99 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.9.14.99
country_id: 690791
description:
[2026-05-10 23:42:16 +0200] info [whostmgrd] 194.9.14.99 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.177.179.40
country_id: 1668284
description:
May 10 23:42:15 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.177.179.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.94
country_id: 130758
description:
May 10 23:47:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.65
country_id: 130758
description:
May 10 23:50:00 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.237
country_id: 130758
description:
May 10 23:50:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.49
country_id: 130758
description:
May 10 23:51:10 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.182.105.73
country_id: 1655842
description:
May 10 23:57:15 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.182.105.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 10 23:57:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 10 23:57:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 10 23:57:58 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.100.138.192
country_id: 1814991
description:
May 11 00:00:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.100.138.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.5.128.67
country_id: 1819730
description:
May 11 00:02:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.5.128.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 11 00:04:42 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
May 11 00:05:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.234.9.125
country_id: 1814991
description:
May 11 00:07:15 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.234.9.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.111.169.105
country_id: 1814991
description:
May 11 00:07:16 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.111.169.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 11 00:15:47 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 11 00:17:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 11 00:18:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.182.105.73
country_id: 1655842
description:
May 11 00:18:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.182.105.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.100.138.192
country_id: 1814991
description:
May 11 00:20:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.100.138.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 11 00:23:15 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 11 00:24:02 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.5.128.67
country_id: 1819730
description:
May 11 00:24:08 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.5.128.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.75.81
country_id: 1835841
description:
May 11 00:25:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.75.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 11 00:34:12 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 11 00:38:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 11 00:43:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 11 00:44:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 11 00:47:16 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.101.74
country_id: 2921044
description:
May 11 00:56:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.68.101.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.245
country_id: 2300660
description:
May 11 00:59:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.216
country_id: 3175395
description:
May 11 01:00:09 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.216
country_id: 3175395
description:
May 11 01:00:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.216 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.219.115.240
country_id: 1880251
description:
[2026-05-11 01:06:12 +0200] info [cpaneld] 8.219.115.240 - cybereli "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cybereli (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.41.92
country_id: 3469034
description:
May 11 01:09:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.41.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 11 01:10:24 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.190.96.234
country_id: 3469034
description:
May 11 03:03:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.190.96.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.190.96.234
country_id: 3469034
description:
May 11 03:03:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.190.96.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.132.159
country_id: 1269750
description:
May 11 03:03:38 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.132.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.26.72.149
country_id: 1861060
description:
[2026-05-11 03:20:37 +0200] info [whostmgrd] 82.26.72.149 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 82.26.72.149
country_id: 1861060
description:
[2026-05-11 03:20:40 +0200] info [whostmgrd] 82.26.72.149 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.245.82.72
country_id: 798544
description:
May 11 04:01:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.245.82.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.12
country_id: 3469034
description:
May 11 04:01:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 11 04:02:10 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 11 04:02:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.112.143
country_id: 1668284
description:
May 11 04:35:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.112.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.143
country_id: 1668284
description:
2026-05-11 04:35:07 dovecot_login authenticator failed for H=110-25-112-143.adsl.fetnet.net ([67.201.39.9]) [110.25.112.143]:40578: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.111.45.158
country_id: 1643084
description:
[2026-05-11 05:48:30 +0200] info [whostmgrd] 27.111.45.158 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.111.45.158
country_id: 1643084
description:
[2026-05-11 05:48:32 +0200] info [whostmgrd] 27.111.45.158 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 11 06:43:11 india kernel: php-fpm[1784109]: segfault at 7f3befe4c2c6 ip 00007f3bfc737777 sp 00007fffcd5fe0e8 error 4 in opcache.so[7f3bfc700000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.183.204
country_id: 3469034
description:
May 11 07:01:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.183.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.206.215
country_id: 1168579
description:
2026-05-11 07:12:13 dovecot_plain authenticator failed for H=(glingen) [221.120.206.215]:57705: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.82.103
country_id: 3469034
description:
May 11 07:12:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.82.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.162.56.186
country_id: 2017370
description:
May 11 07:18:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.162.56.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.162.56.186
country_id: 2017370
description:
2026-05-11 07:18:07 dovecot_login authenticator failed for H=([121.178.185.141]) [82.162.56.186]:56518: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.205.8.130
country_id: 1814991
description:
May 11 07:18:18 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.205.8.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.205.8.130
country_id: 1814991
description:
2026-05-11 07:18:20 dovecot_login authenticator failed for H=([36.135.107.56]) [124.205.8.130]:30290: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-05-11 07:17:45 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi ([1.223.184.226]) [80.223.200.184]:38296: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.150
country_id: 1269750
description:
2026-05-11 07:18:38 dovecot_login authenticator failed for H=([182.79.126.100]) [182.95.230.150]:45576: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.119
country_id: 99237
description:
2026-05-11 07:18:37 dovecot_login authenticator failed for H=(ip72-195-114-171.oc.oc.cox.net) [65.20.237.119]:43945: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.59.90.49
country_id: 2661886
description:
May 11 07:18:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.59.90.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.90.49
country_id: 2661886
description:
2026-05-11 07:18:33 dovecot_login authenticator failed for H=h-46-59-90-49.a463.priv.bahnhof.se ([92.47.46.174]) [46.59.90.49]:42852: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.237.119
country_id: 99237
description:
May 11 07:18:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.237.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.230.150
country_id: 1269750
description:
May 11 07:18:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.230.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.68
country_id: 1733045
description:
2026-05-11 08:27:32 dovecot_login authenticator failed for H=([199.187.210.51]) [49.125.201.68]:55248: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.226.245.223
country_id: 6252001
description:
[2026-05-11 08:35:14 +0200] info [whostmgrd] 3.226.245.223 - - "GET /openid_connect/cpanelid HTTP/1.1" FAILED LOGIN whostmgrd: openid connect: 'whostmgrd' provider 'cpanelid' encountered an error: (XID 6bdqgb) The [asis,OpenID Connect] provider “cPanelID” is disabled on the service “whostmgrd”.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.91.185.132
country_id: 6252001
description:
[2026-05-11 08:35:18 +0200] info [whostmgrd] 98.91.185.132 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 3.99.50.15
country_id: 6251999
description:
[2026-05-11 08:35:22 +0200] info [whostmgrd] 3.99.50.15 - root "GET / HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [98.91.185.132] != Current IP Address [3.99.50.15]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.100.75
country_id: 798544
description:
May 11 09:16:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.100.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.219.115.240
country_id: 1880251
description:
[2026-05-11 01:06:12 +0200] info [cpaneld] 8.219.115.240 - cyberelite "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cyberelite (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 11 04:02:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.190.96.234
country_id: 3469034
description:
May 11 03:03:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.190.96.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.41.92
country_id: 3469034
description:
May 11 01:09:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.41.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.82.103
country_id: 3469034
description:
May 11 07:12:33 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.82.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.12
country_id: 3469034
description:
May 11 04:02:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.183.204
country_id: 3469034
description:
May 11 07:01:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.183.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.132.159
country_id: 1269750
description:
May 11 03:03:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.132.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.26.72.149
country_id: 1861060
description:
[2026-05-11 03:20:42 +0200] info [whostmgrd] 82.26.72.149 - root "GET /cpsess7819887961/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.111.45.158
country_id: 1643084
description:
[2026-05-11 05:48:32 +0200] info [whostmgrd] 27.111.45.158 - root "GET /cpsess9180551078/json-api/listaccts?api.version=1&searchtype=owner&search=root HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 11 10:25:26 india kernel: php-fpm[1810888]: segfault at 7f3befe4c2c6 ip 00007f3bfc737777 sp 00007fffcd5fd948 error 4 in opcache.so[7f3bfc700000+e4000]


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 11 10:27:25 india kernel: php-fpm[1817397]: segfault at 7f3befe4c2c6 ip 00007f3bfc737777 sp 00007fffcd5fd9a8 error 4 in opcache.so[7f3bfc700000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.36.216
country_id: 2395170
description:
May 11 10:57:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.36.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2026-05-11 11:16:24 dovecot_login authenticator failed for H=([125.19.95.209]) [128.185.254.162]:36920: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.254.162
country_id: 1269750
description:
May 11 11:16:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.254.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.42
country_id: 3175395
description:
May 11 11:20:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.195
country_id: 3175395
description:
May 11 11:21:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.195
country_id: 3175395
description:
May 11 11:21:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.195 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
May 11 12:06:09 india kernel: php-fpm[1825213]: segfault at 7f3befe4c2c6 ip 00007f3bfc737777 sp 00007fffcd5fdcf8 error 4 in opcache.so[7f3bfc700000+e4000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.228
country_id: 2300660
description:
May 11 13:08:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.246.73.81
country_id: 3277605
description:
May 11 13:09:07 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.246.73.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.92
country_id: 3469034
description:
May 11 13:13:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.222
country_id: 1269750
description:
May 11 13:13:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.117
country_id: 690791
description:
2026-05-11 13:16:43 H=([77.83.39.117]) [77.83.39.117]:49973 F=<dpr@priv8shop.com> rejected RCPT <peterpan510@rocketmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.220.68.114
country_id: 51537
description:
May 11 16:08:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.220.68.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.220.68.114
country_id: 51537
description:
May 11 16:08:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.220.68.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.231
country_id: 3469034
description:
May 11 16:48:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.233.238.100
country_id: 6252001
description:
[2026-05-11 17:03:51 +0200] info [whostmgrd] 68.233.238.100 - root "GET /415.shtml HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.135.191
country_id: 1269750
description:
May 11 18:41:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.135.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.67.146
country_id: 2017370
description:
May 11 19:09:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.67.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.67.146
country_id: 2017370
description:
2026-05-11 19:09:47 dovecot_login authenticator failed for H=(110-25-109-60.adsl.fetnet.net) [31.173.67.146]:48054: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
country_id: 1835841
description:
May 11 20:37:07 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-05-11 20:37:09 dovecot_login authenticator failed for H=([14.48.112.8]) [114.202.80.152]:33018: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
country_id: 2017370
description:
2026-05-11 20:37:25 dovecot_login authenticator failed for H=([70.166.167.47]) [95.79.57.221]:59456: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.57.221
country_id: 2017370
description:
May 11 20:37:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.57.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.49
country_id: 3469034
description:
May 11 20:44:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.122.195
country_id: 3865483
description:
2026-05-11 20:47:27 dovecot_plain authenticator failed for H=(P1G39) [200.125.122.195]:65157: 535 Incorrect authentication data (set_id=career@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.90.248.108
country_id: 1814991
description:
2026-05-11 20:50:07 dovecot_login authenticator failed for H=([67.201.38.131]) [182.90.248.108]:31634: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.90.248.108
country_id: 1814991
description:
May 11 20:50:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.90.248.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.188.170.216
country_id: 1643084
description:
May 11 20:56:00 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.188.170.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.192.162
country_id: 1269750
description:
May 11 20:57:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.192.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-05-11 20:57:47 dovecot_login authenticator failed for H=([117.192.42.14]) [152.52.192.162]:53296: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.30.11.253
country_id: 6252001
description:
May 11 20:57:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.30.11.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-05-11 20:57:59 dovecot_login authenticator failed for H=([125.19.163.58]) [23.30.11.253]:55811: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.188.170.216
country_id: 1643084
description:
May 11 21:16:38 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.188.170.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.188.170.216
country_id: 1643084
description:
May 11 21:38:26 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.188.170.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.21.70
country_id: 1562822
description:
2026-05-11 22:30:35 dovecot_login authenticator failed for H=([182.78.122.253]) [27.71.21.70]:10118: 535 Incorrect authentication data (set_id=upport@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.207.194
country_id: 1269750
description:
May 11 22:34:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.207.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.207.194
country_id: 1269750
description:
2026-05-11 22:34:13 dovecot_plain authenticator failed for H=(depis) [128.185.207.194]:51610: 535 Incorrect authentication data (set_id=contact@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 11 23:05:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.122
country_id: 130758
description:
May 11 23:22:14 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.122
country_id: 130758
description:
May 11 23:40:15 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.122
country_id: 130758
description:
May 11 23:58:16 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.65
country_id: 130758
description:
May 11 23:59:53 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.94
country_id: 130758
description:
May 12 00:09:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.49
country_id: 130758
description:
May 12 00:11:10 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.237
country_id: 130758
description:
May 12 00:12:07 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.122
country_id: 130758
description:
May 12 00:16:18 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.65
country_id: 130758
description:
May 12 00:18:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.177.179.40
country_id: 1668284
description:
May 12 00:20:26 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.177.179.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.5.128.67
country_id: 1819730
description:
May 12 00:27:26 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.5.128.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.229.167.18
country_id: 1814991
description:
[2026-05-12 00:29:14 +0200] info [whostmgrd] 111.229.167.18 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 111.229.167.18
country_id: 1814991
description:
[2026-05-12 00:29:17 +0200] info [whostmgrd] 111.229.167.18 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.94
country_id: 130758
description:
May 12 00:28:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.49
country_id: 130758
description:
May 12 00:29:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.237
country_id: 130758
description:
May 12 00:30:54 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.172
country_id: 3865483
description:
May 12 00:31:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.162.20.172
country_id: 3865483
description:
May 12 00:31:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.162.20.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.55.176.39
country_id: 3469034
description:
May 12 00:31:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.55.176.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.130
country_id: 1835841
description:
May 12 00:32:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
country_id: 1835841
description:
2026-05-12 00:32:22 dovecot_login authenticator failed for H=([1.62.89.39]) [1.235.192.130]:35060: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.122
country_id: 130758
description:
May 12 00:34:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.94.9.65
country_id: 130758
description:
May 12 00:36:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.94.9.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.100.138.192
country_id: 1814991
description:
May 12 00:39:19 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.100.138.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.177.179.40
country_id: 1668284
description:
May 12 00:38:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.177.179.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 00:40:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.234.9.125
country_id: 1814991
description:
May 12 00:40:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.234.9.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
May 12 00:43:01 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.234.8.114
country_id: 2017370
description:
May 12 00:45:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.234.8.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2026-05-12 00:45:38 dovecot_login authenticator failed for H=([178.178.194.131]) [213.234.8.114]:59318: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.5.128.67
country_id: 1819730
description:
May 12 00:49:10 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.5.128.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.111.169.105
country_id: 1814991
description:
May 12 00:49:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.111.169.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.100.138.192
country_id: 1814991
description:
May 12 00:59:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.100.138.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 01:00:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.234.9.125
country_id: 1814991
description:
May 12 01:00:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.234.9.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.86.148.242
country_id: 1814991
description:
2026-05-12 01:01:56 dovecot_login authenticator failed for H=([142.215.187.249]) [223.86.148.242]:20182: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.86.148.242
country_id: 1814991
description:
May 12 01:01:54 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.86.148.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
May 12 01:03:13 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.117
country_id: 690791
description:
2026-05-12 01:05:56 H=([77.83.39.117]) [77.83.39.117]:57591 F=<dpr@priv8shop.com> rejected RCPT <peterpan510@rocketmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.111.169.105
country_id: 1814991
description:
May 12 01:10:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.111.169.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.5.128.67
country_id: 1819730
description:
May 12 01:11:01 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.5.128.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.132.31
country_id: 6252001
description:
May 12 01:14:16 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.190.132.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 01:14:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 01:20:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.15.127
country_id: 1814991
description:
May 12 01:20:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.15.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.127
country_id: 1814991
description:
2026-05-12 01:20:59 dovecot_login authenticator failed for H=([111.26.106.118]) [222.128.15.127]:58456: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.234.9.125
country_id: 1814991
description:
May 12 01:21:08 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.234.9.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.100.138.192
country_id: 1814991
description:
May 12 01:20:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.100.138.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 12 01:21:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 01:21:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.149.25
country_id: 2921044
description:
May 12 01:22:13 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.234.75.81
country_id: 1835841
description:
May 12 01:23:38 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.234.75.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.190.242.203
country_id: 1814991
description:
May 12 01:23:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.190.242.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 01:27:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.5.128.67
country_id: 1819730
description:
May 12 01:32:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.5.128.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 01:42:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 01:46:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.9
country_id: 3469034
description:
May 12 01:49:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 01:57:12 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.101.74
country_id: 2921044
description:
May 12 01:57:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.68.101.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 12 02:01:00 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 02:02:07 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 02:02:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 02:04:02 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 02:04:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.93.37
country_id: 1814991
description:
May 12 02:16:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.93.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.93.37
country_id: 1814991
description:
2026-05-12 02:16:30 dovecot_login authenticator failed for H=([61.146.129.133]) [36.135.93.37]:56352: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 12 02:20:56 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 02:22:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 02:23:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 02:23:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.163.54
country_id: 1819730
description:
[2026-05-12 02:25:11 +0200] info [whostmgrd] 104.28.163.54 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 104.28.163.54
country_id: 1819730
description:
[2026-05-12 02:25:12 +0200] info [whostmgrd] 104.28.163.54 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 02:25:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.163.58
country_id: 1269750
description:
May 12 02:26:41 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.163.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-05-12 02:26:43 dovecot_login authenticator failed for H=([174.75.211.195]) [125.19.163.58]:41360: 535 Incorrect authentication data (set_id=upport@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 02:27:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 12 02:40:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 02:42:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 02:43:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.13.214.18
country_id: 1814991
description:
May 12 02:44:44 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.13.214.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.13.214.18
country_id: 1814991
description:
2026-05-12 02:44:46 dovecot_login authenticator failed for H=([49.124.147.252]) [218.13.214.18]:48342: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.101.74
country_id: 2921044
description:
May 12 02:46:25 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.68.101.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 02:47:02 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 02:51:14 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 02:52:47 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 12 03:00:54 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.115.124
country_id: 1814991
description:
2026-05-12 03:01:57 dovecot_login authenticator failed for H=(86.46.62.218.adsl-pool.jlccptt.net.cn) [111.26.115.124]:53014: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.75.42
country_id: 1149361
description:
May 12 03:02:06 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.75.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 03:02:05 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2026-05-12 03:02:08 dovecot_login authenticator failed for H=([58.65.96.141]) [180.94.75.42]:35087: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.115.124
country_id: 1814991
description:
May 12 03:01:55 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.115.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.93.165.103
country_id: 1814991
description:
2026-05-12 03:02:43 dovecot_login authenticator failed for H=([197.251.249.72]) [183.93.165.103]:43038: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.93.165.103
country_id: 1814991
description:
May 12 03:02:41 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.93.165.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 03:04:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 03:08:54 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 03:17:26 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 03:17:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 12 03:22:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 03:22:12 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 03:25:39 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 03:31:24 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.101.74
country_id: 2921044
description:
May 12 03:37:14 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.68.101.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 03:41:43 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 03:42:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 12 03:43:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 03:44:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 03:46:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
country_id: 1668284
description:
2026-05-12 03:48:01 dovecot_login authenticator failed for H=111-70-32-5.emome-ip.hinet.net (c-73-134-117-78.hsd1.md.comcast.net) [111.70.32.5]:40998: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.71.5.165
country_id: 294640
description:
2026-05-12 03:48:24 dovecot_login authenticator failed for H=(nsg-corporate-110.116.187.122.airtel.in) [87.71.5.165]:59757: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.71.5.165
country_id: 294640
description:
May 12 03:48:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.71.5.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 03:53:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.79.205
country_id: 6252001
description:
47.251.79.205 - - [12/May/2026:04:00:05 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6776430&pdata=http%253A%252F%252F156.67.111.41%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778551200 HTTP/1.1" 302 0 156.67.111.41 "http://156.67.111.41:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.79.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.254.76.66
country_id: 6252001
description:
47.254.76.66 - - [12/May/2026:04:00:20 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9922206&pdata=http%253A%252F%252Find2.cyberelite.org%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778551213 HTTP/1.1" 302 0 ind2.cyberelite.org "http://ind2.cyberelite.org:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.254.76.66


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.195.183
country_id: 6252001
description:
47.89.195.183 - - [12/May/2026:03:59:58 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6855529&pdata=http%253A%252F%252Fcyberelite.in%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778551196 HTTP/1.1" 302 0 cyberelite.in "http://cyberelite.in:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.195.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.88.238
country_id: 6252001
description:
47.251.88.238 - - [12/May/2026:03:59:59 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9947248&pdata=http%253A%252F%252Famruttbhatt.com.156-67-111-41.cpanel.site%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778551196 HTTP/1.1" 302 0 amruttbhatt.com.156-67-111-41.cpanel.site "http://amruttbhatt.com.156-67-111-41.cpanel.site:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.88.238


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.227.227
country_id: 6252001
description:
47.77.227.227 - - [12/May/2026:03:59:58 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7052183&pdata=http%253A%252F%252Fkeshvaeng.com%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778551196 HTTP/1.1" 302 0 keshvaeng.com "http://keshvaeng.com:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.227.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.223.127
country_id: 6252001
description:
47.77.223.127 - - [12/May/2026:04:00:01 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7303322&pdata=http%253A%252F%252Fcpcontacts.amruttbhatt.com%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778551197 HTTP/1.1" 302 0 cpcontacts.amruttbhatt.com "http://cpcontacts.amruttbhatt.com:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.223.127


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.24.105
country_id: 6252001
description:
47.251.24.105 - - [12/May/2026:04:00:56 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9814940&pdata=http%253A%252F%252Foceanhospitals.com%253A2082%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778551248 HTTP/1.1" 302 0 oceanhospitals.com "http://oceanhospitals.com:2082/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.24.105


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 04:02:06 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.101.74
country_id: 2921044
description:
May 12 04:02:54 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.68.101.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.248.40
country_id: 1269750
description:
May 12 04:03:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.110.248.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 04:05:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
country_id: 1814991
description:
2026-05-12 04:06:48 dovecot_login authenticator failed for H=([182.95.212.185]) [120.194.50.39]:56952: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
country_id: 1814991
description:
May 12 04:06:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 04:07:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 04:15:02 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 04:21:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 04:28:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 04:30:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.184.110
country_id: 1269750
description:
May 12 04:35:14 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.184.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.110
country_id: 1269750
description:
2026-05-12 04:35:16 dovecot_login authenticator failed for H=(nz185l144.bb122100.ctm.net) [182.95.184.110]:51530: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 04:37:19 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 04:38:37 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 04:41:31 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 04:49:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.44
country_id: 2635167
description:
2026-05-12 04:54:58 H=([64.89.160.44]) [64.89.160.44]:52522 F=<dpr@priv8shop.com> rejected RCPT <Brucebantrootdeskfiles5050@outlook.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 04:54:41 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.101.74
country_id: 2921044
description:
May 12 04:56:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.68.101.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.248.156.49
country_id: 1522867
description:
May 12 04:57:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.248.156.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-05-12 04:57:38 dovecot_login authenticator failed for H=([103.55.89.5]) [109.248.156.49]:40706: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 04:59:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 05:01:04 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 05:10:15 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 05:18:46 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 05:20:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.101.74
country_id: 2921044
description:
May 12 05:21:24 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.68.101.74 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.195.183
country_id: 6252001
description:
47.89.195.183 - - [12/May/2026:05:23:20 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9595287&pdata=http%253A%252F%252Famruttbhatt.com.156-67-111-41.cpanel.site%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778556197 HTTP/1.1" 302 0 amruttbhatt.com.156-67-111-41.cpanel.site "http://amruttbhatt.com.156-67-111-41.cpanel.site:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.195.183


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.254.76.66
country_id: 6252001
description:
47.254.76.66 - - [12/May/2026:05:22:37 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6907540&pdata=http%253A%252F%252Fcyberelite.in%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778556155 HTTP/1.1" 302 0 cyberelite.in "http://cyberelite.in:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.254.76.66


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.88.238
country_id: 6252001
description:
47.251.88.238 - - [12/May/2026:05:22:37 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10120081&pdata=http%253A%252F%252Famruttbhatt.com%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778556155 HTTP/1.1" 302 0 amruttbhatt.com "http://amruttbhatt.com:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.88.238


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.228.238
country_id: 6252001
description:
47.77.228.238 - - [12/May/2026:05:22:37 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13080986&pdata=http%253A%252F%252F156.67.111.41%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778556154 HTTP/1.1" 302 0 156.67.111.41 "http://156.67.111.41:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.228.238


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 208.68.93.231
country_id: 6251999
description:
208.68.93.231 - - [12/May/2026:05:22:41 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10250387&pdata=https%253A%252F%252Findia.myserverlogin.in%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778556157 HTTP/2.0" 302 0 india.myserverlogin.in "https://india.myserverlogin.in:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:208.68.93.231


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [12/May/2026:05:22:47 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10261359&pdata=http%253A%252F%252Fkeshvaeng.com%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778556164 HTTP/1.1" 302 0 keshvaeng.com "http://keshvaeng.com:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.82
country_id: 6252001
description:
47.251.188.82 - - [12/May/2026:05:22:59 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710687&pdata=http%253A%252F%252Famruttbhatt.com.156-67-111-41.cpanel.site%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778556175 HTTP/1.1" 302 0 amruttbhatt.com.156-67-111-41.cpanel.site "http://amruttbhatt.com.156-67-111-41.cpanel.site:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.82


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 47.89.195.183
country_id: 6252001
description:
47.89.195.183 - - [12/May/2026:05:23:14 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6710687&pdata=http%253A%252F%252Famruttbhatt.com.156-67-111-41.cpanel.site%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778556175 HTTP/1.1" 404 561 amruttbhatt.com.156-67-111-41.cpanel.site "http://amruttbhatt.com.156-67-111-41.cpanel.site:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.195.183


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 05:31:01 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 05:31:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 05:43:15 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 05:43:10 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.214.108.138
country_id: 953987
description:
May 12 05:51:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.214.108.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.102.115
country_id: 3469034
description:
May 12 05:52:23 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.102.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.176.82.156
country_id: 1880251
description:
May 12 05:54:06 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.176.82.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.52.165.100
country_id: 1814991
description:
May 12 06:05:10 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.52.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 06:26:24 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.93.37
country_id: 1814991
description:
May 12 06:33:54 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.93.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.93.37
country_id: 1814991
description:
2026-05-12 06:33:56 dovecot_login authenticator failed for H=([184.170.249.69]) [36.135.93.37]:52472: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.41.122
country_id: 1269750
description:
May 12 06:34:13 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.41.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2026-05-12 06:34:15 dovecot_login authenticator failed for H=([182.95.215.181]) [125.23.41.122]:50604: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.181.100.124
country_id: 1269750
description:
[2026-05-12 07:10:27 +0200] info [webmaild] 122.181.100.124 - info@headley.in "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.35
country_id: 953987
description:
May 12 07:17:27 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.213
country_id: 1269750
description:
May 12 07:17:49 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.115
country_id: 1269750
description:
May 12 07:18:56 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 07:21:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.121.172.6
country_id: 953987
description:
May 12 07:22:50 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.121.172.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.121.172.6
country_id: 953987
description:
2026-05-12 07:22:52 dovecot_plain authenticator failed for H=(P1G39) [41.121.172.6]:24449: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.101.74
country_id: 2921044
description:
May 12 07:26:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.68.101.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-05-12 07:46:10 dovecot_login authenticator failed for H=([182.95.228.194]) [125.19.195.66]:51130: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.195.66
country_id: 1269750
description:
May 12 07:46:08 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.195.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.33.76.49
country_id: 3469034
description:
May 12 07:51:40 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.33.76.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.33.76.49
country_id: 3469034
description:
2026-05-12 07:51:42 dovecot_login authenticator failed for H=([49.125.201.73]) [191.33.76.49]:41714: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
country_id: 3469034
description:
May 12 07:51:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
country_id: 3469034
description:
2026-05-12 07:51:50 dovecot_login authenticator failed for H=([102.38.3.107]) [179.185.1.97]:37265: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-05-12 07:52:31 dovecot_login authenticator failed for H=([70.166.167.35]) [219.248.65.30]:41715: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
country_id: 1835841
description:
May 12 07:52:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.107.158
country_id: 226074
description:
May 12 07:52:36 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.107.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-05-12 07:52:38 dovecot_login authenticator failed for H=([123.129.245.249]) [196.0.107.158]:42780: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 08:15:28 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.207.128
country_id: 1269750
description:
[2026-05-12 08:15:34 +0200] info [webmaild] 106.222.207.128 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-05-12 08:26:39 dovecot_login authenticator failed for H=([70.166.167.44]) [114.30.223.119]:49546: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.177
country_id: 1668284
description:
May 12 08:33:41 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-05-12 08:37:45 dovecot_plain authenticator failed for H=h95-155-228-189.cust.bredband2.com (unded) [95.155.228.189]:42882: 535 Incorrect authentication data (set_id=contact@cyberelite.in)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 49.43.5.217
country_id: 1269750
description:
[2026-05-12 09:09:09 +0200] info [cpaneld] 49.43.5.217 NEW bechomaxx:Bf3r40LVcfxDtOY7 address=49.43.5.217,app=cpaneld,creator=bechomaxx,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.215
country_id: 2510769
description:
May 12 09:10:00 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 09:10:18 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.105.214.48
country_id: 3865483
description:
May 12 09:09:38 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.105.214.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 09:37:56 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.79
country_id: 3469034
description:
May 12 09:40:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.79 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.207.128
country_id: 1269750
description:
[2026-05-12 09:40:53 +0200] info [webmaild] 106.222.207.128 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.44.120.79
country_id: 1861060
description:
May 12 10:05:53 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.44.120.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.98.240.47
country_id: 290557
description:
May 12 10:22:29 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.98.240.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.240.47
country_id: 290557
description:
2026-05-12 10:22:31 dovecot_login authenticator failed for H=([221.153.12.93]) [98.98.240.47]:38244: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2026-05-12 10:57:19 dovecot_login authenticator failed for H=([220.121.38.45]) [2.196.202.17]:46446: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.196.202.17
country_id: 3175395
description:
May 12 10:57:17 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.196.202.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.227.252.2
country_id: 1269750
description:
May 12 10:57:32 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.227.252.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2026-05-12 10:57:34 dovecot_login authenticator failed for H=([49.124.153.29]) [110.227.252.2]:52078: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2026-05-12 10:58:01 dovecot_login authenticator failed for H=(177-174-105-113.user.vivozap.com.br) [125.23.41.122]:41630: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.41.122
country_id: 1269750
description:
May 12 10:57:59 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.41.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 122.181.100.124
country_id: 1269750
description:
[2026-05-12 11:01:43 +0200] info [webmaild] 122.181.100.124 - info@headley.in "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 106.222.207.128
country_id: 1269750
description:
[2026-05-12 11:17:19 +0200] info [webmaild] 106.222.207.128 - amruttbhatt@bechomaxx.com "GET /skins/elastic/images/favicon.ico?s=1774777728 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 49.43.4.160
country_id: 1269750
description:
[2026-05-12 11:35:47 +0200] info [cpaneld] 49.43.4.160 NEW bechomaxx:zZ6uPogQpGixFnGy address=49.43.4.160,app=cpaneld,creator=bechomaxx,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.101.79.13
country_id: 1814991
description:
May 12 12:37:58 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.101.79.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.101.79.13
country_id: 1814991
description:
2026-05-12 12:38:00 dovecot_login authenticator failed for H=([182.95.217.182]) [114.101.79.13]:42104: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.66
country_id: 1269750
description:
2026-05-12 12:44:47 dovecot_login authenticator failed for H=([49.124.151.20]) [182.95.232.66]:48122: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.94.26.70
country_id: 3469034
description:
May 12 13:56:58 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.94.26.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.106.110
country_id: 798544
description:
May 12 13:57:19 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.106.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.106.110
country_id: 798544
description:
May 12 13:57:26 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.106.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.41.122
country_id: 1269750
description:
May 12 14:20:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.41.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2026-05-12 14:20:22 dovecot_login authenticator failed for H=([67.201.35.147]) [125.23.41.122]:42086: 535 Incorrect authentication data (set_id=upport@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.11.75
country_id: 1512440
description:
May 12 14:22:21 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.11.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.68.148.0
country_id: 2017370
description:
May 12 14:22:26 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.68.148.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.90.235
country_id: 1668284
description:
May 12 14:23:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.90.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
May 12 14:23:51 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:35:28 india sshd[2024599]: Accepted publickey for root from 171.60.138.162 port 51012 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:39:41 india sshd[2029686]: Accepted publickey for root from 171.60.138.162 port 51170 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:41:29 india sshd[2031166]: Accepted publickey for root from 171.60.138.162 port 51233 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:42:23 india sshd[2031527]: Accepted publickey for root from 171.60.138.162 port 51270 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:44:56 india sshd[2031767]: Accepted publickey for root from 171.60.138.162 port 51353 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:45:51 india sshd[2032272]: Accepted publickey for root from 171.60.138.162 port 51389 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:46:48 india sshd[2032570]: Accepted publickey for root from 171.60.138.162 port 51436 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:47:46 india sshd[2033847]: Accepted publickey for root from 171.60.138.162 port 51471 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:48:27 india sshd[2034077]: Accepted publickey for root from 171.60.138.162 port 51496 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:53:45 india sshd[2034715]: Accepted publickey for root from 171.60.138.162 port 51715 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.212.198.153
country_id: 1814991
description:
[2026-05-12 14:55:05 +0200] info [whostmgrd] 118.212.198.153 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 118.212.198.153
country_id: 1814991
description:
[2026-05-12 14:55:07 +0200] info [whostmgrd] 118.212.198.153 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:56:47 india sshd[2035136]: Accepted publickey for root from 171.60.138.162 port 51819 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:57:22 india sshd[2035426]: Accepted publickey for root from 171.60.138.162 port 51837 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 171.60.138.162
country_id: 1269750
description:
May 12 14:58:26 india sshd[2035935]: Accepted publickey for root from 171.60.138.162 port 51881 ssh2: RSA SHA256:ktSkiD87A/o0QUJEoR4Q2ATtZESbz4hsUEE+Znyw0cQ


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 15:07:48 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 15:34:03 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 15:47:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 15:48:09 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.94
country_id: 732800
description:
May 12 15:49:15 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.207
country_id: 2510769
description:
May 12 15:50:11 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.94
country_id: 732800
description:
May 12 15:49:22 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.207
country_id: 2510769
description:
May 12 15:50:24 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.69.160
country_id: 1814991
description:
2026-05-12 15:50:27 dovecot_login authenticator failed for H=([70.166.167.59]) [111.26.69.160]:40366: 535 Incorrect authentication data (set_id=support@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.146.187
country_id: 6252001
description:
May 12 16:00:35 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.223.146.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 16:09:07 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 16:09:37 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 16:31:57 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.216.189
country_id: 6252001
description:
47.77.216.189 - - [12/May/2026:16:33:29 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9935210&pdata=http%253A%252F%252F156.67.111.41%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778596405 HTTP/1.1" 302 0 156.67.111.41 "http://156.67.111.41:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.216.189


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.79.205
country_id: 6252001
description:
47.251.79.205 - - [12/May/2026:16:33:35 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12884681&pdata=http%253A%252F%252Find2.cyberelite.org%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778596412 HTTP/1.1" 302 0 ind2.cyberelite.org "http://ind2.cyberelite.org:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.79.205


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.77.227.227
country_id: 6252001
description:
47.77.227.227 - - [12/May/2026:16:33:36 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9946729&pdata=http%253A%252F%252Fwww.amruttbhatt.com%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778596413 HTTP/1.1" 302 0 www.amruttbhatt.com "http://www.amruttbhatt.com:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.77.227.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.246.29
country_id: 6252001
description:
47.89.246.29 - - [12/May/2026:16:33:37 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9859182&pdata=http%253A%252F%252Fwww.amrutdrumcircle.com%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778596414 HTTP/1.1" 302 0 www.amrutdrumcircle.com "http://www.amrutdrumcircle.com:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.246.29


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.88.94.125
country_id: 6252001
description:
47.88.94.125 - - [12/May/2026:16:33:27 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6788506&pdata=http%253A%252F%252Famruttbhatt.com%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778596402 HTTP/1.1" 302 0 amruttbhatt.com "http://amruttbhatt.com:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.88.94.125


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.186.126
country_id: 6252001
description:
47.251.186.126 - - [12/May/2026:16:33:27 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10393546&pdata=http%253A%252F%252Fkeshvaeng.com%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778596403 HTTP/1.1" 302 0 keshvaeng.com "http://keshvaeng.com:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.186.126


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.89.195.183
country_id: 6252001
description:
47.89.195.183 - - [12/May/2026:16:34:30 +0200] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12882843&pdata=http%253A%252F%252Fcpcontacts.amruttbhatt.com%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1778596465 HTTP/1.1" 302 0 cpcontacts.amruttbhatt.com "http://cpcontacts.amruttbhatt.com:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.89.195.183


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.71.84.38
country_id: 3469034
description:
2026-05-12 16:48:37 dovecot_plain authenticator failed for H=(ceplaic) [200.71.84.38]:57762: 535 Incorrect authentication data (set_id=namit@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 16:49:20 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.95
country_id: 2635167
description:
2026-05-12 16:50:55 H=([64.89.160.95]) [64.89.160.95]:55739 F=<dpr@priv8shop.com> rejected RCPT <johndocument1@outlook.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 16:54:30 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.217.106.60
country_id: 2661886
description:
May 12 17:09:34 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.217.106.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.57.229.134
country_id: 6252001
description:
[2026-05-12 17:13:26 +0200] info [whostmgrd] 13.57.229.134 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 13.57.229.134
country_id: 6252001
description:
[2026-05-12 17:13:28 +0200] info [whostmgrd] 13.57.229.134 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 17:17:02 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.250.181.129
country_id: 6252001
description:
[2026-05-12 17:35:26 +0200] info [whostmgrd] 44.250.181.129 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 44.250.181.129
country_id: 6252001
description:
[2026-05-12 17:35:28 +0200] info [whostmgrd] 44.250.181.129 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 18.227.209.48
country_id: 6252001
description:
[2026-05-12 17:37:59 +0200] info [whostmgrd] 18.227.209.48 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 18.227.209.48
country_id: 6252001
description:
[2026-05-12 17:38:00 +0200] info [whostmgrd] 18.227.209.48 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.219.240.183
country_id: 6252001
description:
[2026-05-12 17:38:11 +0200] info [whostmgrd] 54.219.240.183 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 54.219.240.183
country_id: 6252001
description:
[2026-05-12 17:38:13 +0200] info [whostmgrd] 54.219.240.183 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-05-12 17:38:16 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (pernifetis) [76.157.219.158]:40718: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.157.219.158
country_id: 6252001
description:
May 12 17:38:14 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.157.219.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-05-12 17:38:20 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (unded) [24.98.45.238]:37598: 535 Incorrect authentication data (set_id=info@cyberelite.in)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.98.45.238
country_id: 6252001
description:
May 12 17:38:18 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.98.45.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
May 12 17:39:45 india auth[711509]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 44.249.178.238
country_id: 6252001
description:
[2026-05-12 17:41:36 +0200] info [whostmgrd] 44.249.178.238 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 44.249.178.238
country_id: 6252001
description:
[2026-05-12 17:41:37 +0200] info [whostmgrd] 44.249.178.238 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.208.246.211
country_id: 1861060
description:
[2026-05-12 17:43:38 +0200] info [whostmgrd] 13.208.246.211 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 13.208.246.211
country_id: 1861060
description:
[2026-05-12 17:43:38 +0200] info [whostmgrd] 13.208.246.211 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


