# incident

plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:03:49 servidor sshd[159919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.135.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:03:49 servidor sshd[159919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.135.20  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:04:29 servidor sshd[160826]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.198.146.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:04:29 servidor sshd[160826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.146.227  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:05:41 servidor sshd[161851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.146.227  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:05:03 servidor sshd[161490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.137.249.148  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:05:04 servidor sshd[161661]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.135.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:05:11 servidor sshd[161691]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.82.90.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:05:15 servidor sshd[161702]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.217.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:05:11 servidor sshd[161691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.82.90.210  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:05:15 servidor sshd[161702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.217.28  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:05:41 servidor sshd[161851]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.198.146.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:05:03 servidor sshd[161490]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.137.249.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:05:04 servidor sshd[161661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.135.20  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:06:12 servidor sshd[162799]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.135.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:06:12 servidor sshd[162799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.135.20  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:06:26 servidor sshd[163084]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.82.90.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 11:06:21 servidor sshd[163051]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 11:06:21 servidor sshd[163051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:06:26 servidor sshd[163084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.82.90.210  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.52.21.96
country_id: 6251999
description:
Jul 13 11:06:36 servidor sshd[163101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.52.21.96


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.52.21.96
country_id: 6251999
description:
Jul 13 11:06:36 servidor sshd[163101]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.52.21.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:06:40 servidor sshd[163143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.217.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:06:40 servidor sshd[163143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.217.28  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:07:22 servidor sshd[163352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.135.20  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:07:41 servidor sshd[163421]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.82.90.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:06:54 servidor sshd[163189]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.198.146.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:06:54 servidor sshd[163189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.146.227  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.247.24.89
country_id: 1835841
description:
Jul 13 11:06:58 servidor sshd[163256]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.247.24.89 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.247.24.89
country_id: 1835841
description:
Jul 13 11:06:58 servidor sshd[163256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.24.89  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:07:14 servidor sshd[163329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.137.249.148  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:07:14 servidor sshd[163329]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.137.249.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:07:41 servidor sshd[163421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.82.90.210  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:07:22 servidor sshd[163352]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.135.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:08:02 servidor sshd[163649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.217.28  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:08:15 servidor sshd[163849]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.198.146.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:08:15 servidor sshd[163849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.146.227  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:08:02 servidor sshd[163649]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.217.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 196.251.84.225
country_id: 2750405
description:
Jul 13 11:08:59 servidor sshd[164097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.251.84.225


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 11:09:36 -0300] info [cpaneld] 185.243.96.5 - James "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user James (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:09:38 servidor sshd[164264]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.137.249.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:09:38 servidor sshd[164264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.137.249.148  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.84.225
country_id: 2750405
description:
Jul 13 11:08:59 servidor sshd[164097]: pam_imunify(sshd:auth): [IM360_RBL] The IP 196.251.84.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 11:10:22 servidor sshd[164639]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 11:10:22 servidor sshd[164639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.83.190
country_id: 1861060
description:
Jul 13 11:10:58 servidor sshd[164686]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.95.83.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.95.83.190
country_id: 1861060
description:
Jul 13 11:10:58 servidor sshd[164686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.83.190  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.236.164
country_id: 1562822
description:
Jul 13 11:12:02 servidor sshd[165041]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.172.236.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.172.236.164
country_id: 1562822
description:
Jul 13 11:12:02 servidor sshd[165041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.172.236.164


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 168.228.250.10
country_id: 3895114
description:
Jul 13 11:12:42 servidor sshd[165127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.228.250.10  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.134.22.66
country_id: 1880251
description:
Jul 13 11:14:35 servidor sshd[165505]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.134.22.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.134.22.66
country_id: 1880251
description:
Jul 13 11:14:35 servidor sshd[165505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.134.22.66


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 11:14:02 servidor sshd[165421]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 11:14:02 servidor sshd[165421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.81


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 11:17:16 servidor sshd[167016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.226.84.145  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:28 servidor sshd[167052]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.120.189.255 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:28 servidor sshd[167052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.120.189.255  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:30 servidor sshd[167052]: Failed password for root from 181.120.189.255 port 51572 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 11:17:16 servidor sshd[167016]: pam_imunify(sshd:auth): [IM360_RBL] The IP 1.226.84.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:55 servidor sshd[167093]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.120.189.255 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:55 servidor sshd[167093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.120.189.255  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:56 servidor sshd[167093]: Failed password for root from 181.120.189.255 port 52825 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-07-13 11:18:05 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:35652: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.177.116
country_id: 6252001
description:
Jul 13 11:18:19 servidor sshd[167221]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.177.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.177.116
country_id: 6252001
description:
Jul 13 11:18:19 servidor sshd[167221]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.177.116  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2025-07-13 11:18:24 dovecot_login authenticator failed for ([220.161.52.149]) [220.161.52.149]:58149: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:19:12 servidor sshd[167485]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:19:12 servidor sshd[167485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.60  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.107.214
country_id: 1814991
description:
Jul 13 11:20:15 servidor sshd[167821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.107.214  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.107.214
country_id: 1814991
description:
Jul 13 11:20:15 servidor sshd[167821]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.107.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.83.15.200
country_id: 1819730
description:
Jul 13 11:20:49 servidor sshd[167861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.83.15.200  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:22:31 servidor sshd[168426]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:22:31 servidor sshd[168426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.60  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.83.15.200
country_id: 1819730
description:
Jul 13 11:22:55 servidor sshd[168473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.83.15.200  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:23:51 servidor sshd[168665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.60  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
country_id: 1643084
description:
Jul 13 11:24:01 servidor sshd[168735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.83.15.200
country_id: 1819730
description:
Jul 13 11:24:19 servidor sshd[168833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.83.15.200  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:23:51 servidor sshd[168665]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
country_id: 1643084
description:
Jul 13 11:24:01 servidor sshd[168735]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.83.15.200
country_id: 1819730
description:
Jul 13 11:24:19 servidor sshd[168833]: pam_imunify(sshd:auth): [IM360_RBL] The IP 154.83.15.200 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 11:25:43 servidor sshd[169230]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:40 servidor sshd[169917]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:40 servidor sshd[169917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.149.235.152  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:42 servidor sshd[169917]: Failed password for root from 218.149.235.152 port 46640 ssh2


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:50 servidor sshd[169922]: Failed password for invalid user admin from 218.149.235.152 port 57882 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:57 servidor sshd[169944]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:57 servidor sshd[169944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.149.235.152


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 11:29:27 servidor sshd[170107]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 11:29:27 servidor sshd[170107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.4.70.205
country_id: 690791
description:
Jul 13 11:31:15 servidor sshd[171223]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.4.70.205 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.4.70.205
country_id: 690791
description:
Jul 13 11:31:15 servidor sshd[171223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.4.70.205


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 11:31:36 servidor sshd[171532]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 11:31:36 servidor sshd[171532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 11:31:59 servidor sshd[171585]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.156.209
country_id: 1835841
description:
2025-07-13 11:32:44 dovecot_login authenticator failed for ([119.207.156.209]) [119.207.156.209]:6745: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 11:32:28 servidor sshd[171757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 11:32:28 servidor sshd[171757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.19.246.172
country_id: 1814991
description:
2025-07-13 11:33:04 dovecot_login authenticator failed for ([183.93.198.164]) [58.19.246.172]:42422: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.142.143.51
country_id: 298795
description:
Jul 13 11:34:22 servidor sshd[175234]: pam_imunify(sshd:auth): [IM360_RBL] The IP 213.142.143.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 213.142.143.51
country_id: 298795
description:
Jul 13 11:34:22 servidor sshd[175234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.142.143.51


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.164.199.128
country_id: 6252001
description:
Jul 13 11:35:40 servidor sshd[175853]: pam_imunify(sshd:auth): [IM360_RBL] The IP 76.164.199.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 76.164.199.128
country_id: 6252001
description:
Jul 13 11:35:40 servidor sshd[175853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.164.199.128  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 11:36:23 -0300] info [cpaneld] 185.243.96.5 - John "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user John (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.107.214
country_id: 1814991
description:
Jul 13 11:37:51 servidor sshd[176313]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.107.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.107.214
country_id: 1814991
description:
Jul 13 11:37:51 servidor sshd[176313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.107.214  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.93.89.118
country_id: 130758
description:
Jul 13 11:38:11 servidor sshd[176316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.93.89.118  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.214.244
country_id: 2921044
description:
Jul 13 11:38:18 servidor sshd[176542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.214.244


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.93.89.118
country_id: 130758
description:
Jul 13 11:39:12 servidor sshd[176800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.93.89.118  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.252.90.190
country_id: 3017382
description:
Jul 13 11:41:53 servidor sshd[177635]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.252.90.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.252.90.190
country_id: 3017382
description:
Jul 13 11:41:53 servidor sshd[177635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.252.90.190


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.145.72.84
country_id: 3017382
description:
Jul 13 11:42:17 servidor sshd[177693]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.145.72.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.145.72.84
country_id: 3017382
description:
Jul 13 11:42:17 servidor sshd[177693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.145.72.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.79.180.221
country_id: 2635167
description:
Jul 13 11:43:31 servidor sshd[178083]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.79.180.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.79.180.221
country_id: 2635167
description:
Jul 13 11:43:31 servidor sshd[178083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.79.180.221  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.157
country_id: 798549
description:
Jul 13 11:43:02 servidor sshd[177805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.157  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 11:44:00 servidor sshd[178176]: Invalid user radioitaboraisantos from 193.32.162.218 port 45906


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 11:44:00 servidor sshd[178176]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 11:44:00 servidor sshd[178176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
country_id: 1269750
description:
Jul 13 11:44:10 servidor sshd[178211]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
country_id: 1269750
description:
Jul 13 11:44:10 servidor sshd[178211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 11:45:14 servidor sshd[178532]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 11:45:14 servidor sshd[178532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 11:46:12 servidor sshd[179404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.214.244
country_id: 2921044
description:
Jul 13 11:45:51 servidor sshd[179323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.214.244


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 11:46:12 servidor sshd[179404]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 11:46:57 servidor sshd[179558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 11:46:57 servidor sshd[179558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.246.224.218  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 11:46:59 servidor sshd[179558]: Failed password for root from 106.246.224.218 port 40772 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.190.104
country_id: 6252001
description:
Jul 13 11:48:12 servidor sshd[179875]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.169.190.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.169.190.104
country_id: 6252001
description:
Jul 13 11:48:12 servidor sshd[179875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.190.104


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:48:22 servidor sshd[179834]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.29.145.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:48:22 servidor sshd[179834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.29.145.180  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 11:49:30 servidor sshd[180237]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 11:49:30 servidor sshd[180237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 11:49:32 servidor sshd[180237]: Failed password for redestreamhost from 92.118.39.34 port 36676 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.128.94
country_id: 2750405
description:
Jul 13 11:50:09 servidor sshd[180525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.128.94


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.55.179
country_id: 2921044
description:
Jul 13 11:52:46 servidor sshd[183907]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.55.179 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.55.179
country_id: 2921044
description:
Jul 13 11:52:46 servidor sshd[183907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.55.179  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.149.146.202
country_id: 2921044
description:
Jul 13 11:53:03 servidor sshd[184001]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.149.146.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.214.244
country_id: 2921044
description:
Jul 13 11:53:31 servidor sshd[184086]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.214.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.30.45.112
country_id: 1562822
description:
Jul 13 11:53:46 servidor sshd[184188]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.30.45.112 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.30.45.112
country_id: 1562822
description:
Jul 13 11:53:46 servidor sshd[184188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.30.45.112


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.149.146.202
country_id: 2921044
description:
Jul 13 11:53:03 servidor sshd[184001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.149.146.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
country_id: 6252001
description:
2025-07-13 11:53:03 dovecot_login authenticator failed for visaustralia.com [216.70.104.41]:57652: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
country_id: 1814991
description:
2025-07-13 11:53:17 dovecot_login authenticator failed for ([220.172.203.43]) [220.172.203.43]:35853: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.214.244
country_id: 2921044
description:
Jul 13 11:53:31 servidor sshd[184086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.214.244


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:55:29 servidor sshd[184531]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.29.145.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:55:29 servidor sshd[184531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.29.145.180  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 11:56:26 servidor sshd[184982]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:56:03 servidor sshd[184814]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.29.145.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:56:03 servidor sshd[184814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.29.145.180  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.214.6.212
country_id: 2750405
description:
Jul 13 11:57:35 servidor sshd[185180]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.214.6.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.214.6.212
country_id: 2750405
description:
Jul 13 11:57:35 servidor sshd[185180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.214.6.212


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.132.58.31
country_id: 3017382
description:
Jul 13 11:56:51 servidor sshd[185071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.58.31


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.35.174.186
country_id: 2635167
description:
Jul 13 11:57:20 servidor sshd[185144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.174.186


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.128.94
country_id: 2750405
description:
Jul 13 11:57:47 servidor sshd[185241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.128.94


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.132.58.31
country_id: 3017382
description:
Jul 13 11:56:51 servidor sshd[185071]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.132.58.31 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 11:58:39 servidor sshd[185375]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.128.94
country_id: 2750405
description:
Jul 13 11:57:49 servidor sshd[185241]: Failed password for invalid user TestUser from 152.42.128.94 port 50512 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 12:01:12 servidor sshd[186897]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 12:01:12 servidor sshd[186897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.35.174.186
country_id: 2635167
description:
Jul 13 12:03:44 servidor sshd[187293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.174.186


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 12:03:44 -0300] info [cpaneld] 185.243.96.5 - Joshua "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Joshua (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.100
country_id: 6252001
description:
Jul 13 12:04:04 servidor sshd[187434]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.100
country_id: 6252001
description:
Jul 13 12:04:04 servidor sshd[187434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.100


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 12:04:19 servidor sshd[187460]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 12:04:19 servidor sshd[187460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.128.94
country_id: 2750405
description:
Jul 13 12:05:31 servidor sshd[187939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.128.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.129.246.99
country_id: 357994
description:
2025-07-13 12:06:05 dovecot_login authenticator failed for ([82.129.246.99]) [82.129.246.99]:23790: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
country_id: 1814991
description:
2025-07-13 12:06:27 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:37601: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:06:50 servidor sshd[188194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.166.172 has been locked due to Imunify RBL


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:06:52 servidor sshd[188194]: Failed password for root from 175.126.166.172 port 38846 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:07:24 servidor sshd[188567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.55  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:07:24 servidor sshd[188567]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 12:06:50 servidor sshd[188192]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 12:06:50 servidor sshd[188192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:06:50 servidor sshd[188194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.166.172  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:08:44 servidor sshd[188786]: Failed password for root from 107.150.110.167 port 49760 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:08:06 servidor sshd[188709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.49.152.12  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:08:12 servidor sshd[188733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.107.36.246  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:08:41 servidor sshd[188786]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.150.110.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:08:41 servidor sshd[188786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.150.110.167  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:08:06 servidor sshd[188709]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.49.152.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:08:12 servidor sshd[188733]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.107.36.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:08:54 servidor sshd[188864]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.176.184.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:08:54 servidor sshd[188864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.176.184.113


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.35.174.186
country_id: 2635167
description:
Jul 13 12:10:08 servidor sshd[189337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.174.186


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:10:46 servidor sshd[189444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.166.172  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:09:54 servidor sshd[188983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.47.238.57  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:10:40 servidor sshd[189431]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.176.184.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:10:40 servidor sshd[189431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.176.184.113  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:10:46 servidor sshd[189444]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.166.172 has been locked due to Imunify RBL


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:10:47 servidor sshd[189444]: Failed password for root from 175.126.166.172 port 54612 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:09:54 servidor sshd[188983]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.47.238.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:11:30 servidor sshd[189621]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.150.110.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:11:48 servidor sshd[189643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.176.184.113  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:11:16 servidor sshd[189586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.55  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:11:29 servidor sshd[189616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.47.238.57 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:11:09 servidor sshd[189565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.49.152.12  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:11:16 servidor sshd[189586]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:11:30 servidor sshd[189621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.150.110.167  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:11:09 servidor sshd[189565]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.49.152.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.233.89.161
country_id: 1880251
description:
[2025-07-13 12:11:11 -0300] info [whostmgrd] 194.233.89.161 - distakec "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:11:48 servidor sshd[189643]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.176.184.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:11:29 servidor sshd[189616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.47.238.57  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:11:32 servidor sshd[189621]: Failed password for root from 107.150.110.167 port 37356 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:12:44 servidor sshd[189924]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.49.152.12 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:12:44 servidor sshd[189924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.49.152.12  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:12:14 servidor sshd[189796]: Failed password for root from 175.126.166.172 port 40996 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:12:35 servidor sshd[189880]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:12:13 servidor sshd[189796]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.166.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:12:13 servidor sshd[189796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.166.172  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:12:35 servidor sshd[189880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.55  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:12:56 servidor sshd[189991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.47.238.57 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:12:56 servidor sshd[189991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.47.238.57  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:13:39 servidor sshd[190228]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.107.36.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:13:39 servidor sshd[190228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.107.36.246  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:13:01 servidor sshd[190097]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.150.110.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:13:01 servidor sshd[190097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.150.110.167  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:13:03 servidor sshd[190097]: Failed password for root from 107.150.110.167 port 10326 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:15:38 servidor sshd[191537]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.107.36.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:15:38 servidor sshd[191537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.107.36.246  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 12:18:00 servidor sshd[191984]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 12:18:00 servidor sshd[191984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
country_id: 2017370
description:
2025-07-13 12:18:18 dovecot_login authenticator failed for ([95.79.57.221]) [95.79.57.221]:60622: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.204.231
country_id: 3865483
description:
2025-07-13 12:18:36 dovecot_login authenticator failed for ([186.5.204.231]) [186.5.204.231]:43904: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.213.140.50
country_id: 3017382
description:
Jul 13 12:20:03 servidor sshd[192556]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.213.140.50 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 89.213.140.50
country_id: 3017382
description:
Jul 13 12:20:03 servidor sshd[192556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.213.140.50


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.40.199
country_id: 2750405
description:
Jul 13 12:23:31 servidor sshd[193623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.40.199


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 12:24:01 servidor sshd[193700]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 12:24:01 servidor sshd[193700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.115


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.128.112.74
country_id: 732800
description:
Jul 13 12:26:02 servidor sshd[194166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.128.112.74


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 147.182.206.75
country_id: 6252001
description:
Jul 13 12:26:52 servidor sshd[194460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.182.206.75  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.92.223.147
country_id: 2750405
description:
Jul 13 12:27:36 servidor sshd[194604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.223.147


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.206.75
country_id: 6252001
description:
Jul 13 12:26:52 servidor sshd[194460]: pam_imunify(sshd:auth): [IM360_RBL] The IP 147.182.206.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.98.0
country_id: 1880251
description:
Jul 13 12:30:25 servidor sshd[195314]: pam_imunify(sshd:auth): [IM360_RBL] The IP 134.209.98.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 134.209.98.0
country_id: 1880251
description:
Jul 13 12:30:25 servidor sshd[195314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.98.0  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.40.199
country_id: 2750405
description:
Jul 13 12:31:01 servidor sshd[196120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.40.199


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.48.221
country_id: 1880251
description:
Jul 13 12:31:48 servidor sshd[196350]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.48.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.48.221
country_id: 1880251
description:
Jul 13 12:31:48 servidor sshd[196350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.48.221


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.48.221
country_id: 1880251
description:
Jul 13 12:31:50 servidor sshd[196350]: Failed password for invalid user adcolheita from 157.245.48.221 port 57852 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 12:32:43 -0300] info [cpaneld] 185.243.96.5 - Daniel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Daniel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.207.15.4
country_id: 1814991
description:
2025-07-13 12:32:43 dovecot_login authenticator failed for ([140.207.15.4]) [140.207.15.4]:35202: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.115.125
country_id: 6252001
description:
Jul 13 12:33:02 servidor sshd[196585]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.115.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
country_id: 6252001
description:
Jul 13 12:33:02 servidor sshd[196585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-07-13 12:33:05 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:45213: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:33:58 servidor sshd[196773]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.235.16.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:33:58 servidor sshd[196773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.235.16.111  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:34:10 servidor sshd[196812]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.8.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:34:10 servidor sshd[196812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.8.63  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:35:28 servidor sshd[197323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.8.63  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:35:32 servidor sshd[197329]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.235.16.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:35:32 servidor sshd[197329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.235.16.111  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.92.223.147
country_id: 2750405
description:
Jul 13 12:35:11 servidor sshd[197226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.223.147


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:35:28 servidor sshd[197323]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.8.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.75.185.71
country_id: 1814991
description:
Jul 13 12:34:52 servidor sshd[197007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.75.185.71  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.231.110.214
country_id: 6252001
description:
Jul 13 12:36:46 servidor sshd[197671]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.231.110.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.231.110.214
country_id: 6252001
description:
Jul 13 12:36:46 servidor sshd[197671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.231.110.214  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 12:36:46 servidor sshd[197669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:36:47 servidor sshd[197678]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.235.16.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:36:47 servidor sshd[197678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.235.16.111  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 207.231.110.214
country_id: 6252001
description:
Jul 13 12:36:48 servidor sshd[197671]: Failed password for root from 207.231.110.214 port 53450 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:36:34 servidor sshd[197500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.8.63  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:36:34 servidor sshd[197500]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.8.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.220.124.69
country_id: 2921044
description:
Jul 13 12:37:08 servidor sshd[197796]: pam_imunify(sshd:auth): [IM360_RBL] The IP 158.220.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 158.220.124.69
country_id: 2921044
description:
Jul 13 12:37:08 servidor sshd[197796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.220.124.69


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.40.199
country_id: 2750405
description:
Jul 13 12:38:42 servidor sshd[198108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.40.199


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.92.223.147
country_id: 2750405
description:
Jul 13 12:42:54 servidor sshd[199256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.223.147


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.75.185.71
country_id: 1814991
description:
Jul 13 12:44:15 servidor sshd[199749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.75.185.71  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.155.137.173
country_id: 1643084
description:
Jul 13 12:44:46 servidor sshd[199846]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.155.137.173 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.155.137.173
country_id: 1643084
description:
Jul 13 12:44:46 servidor sshd[199846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.155.137.173


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.155.137.173
country_id: 1643084
description:
Jul 13 12:44:49 servidor sshd[199846]: Failed password for invalid user adcolheita from 202.155.137.173 port 57126 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.176.84.4
country_id: 6252001
description:
Jul 13 12:45:07 servidor sshd[200055]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.176.84.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.176.84.4
country_id: 6252001
description:
Jul 13 12:45:07 servidor sshd[200055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.176.84.4  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 88.214.236.61
country_id: 2017370
description:
Jul 13 12:46:32 servidor sshd[201069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.214.236.61  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 12:47:24 servidor sshd[201301]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.75.185.71
country_id: 1814991
description:
Jul 13 12:48:45 servidor sshd[201579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.75.185.71  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.75.185.71
country_id: 1814991
description:
Jul 13 12:48:45 servidor sshd[201579]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.75.185.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.127.104
country_id: 2750405
description:
Jul 13 12:50:30 servidor sshd[202040]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.112.127.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.112.127.104
country_id: 2750405
description:
Jul 13 12:50:30 servidor sshd[202040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.112.127.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.3.140.29
country_id: 1814991
description:
2025-07-13 12:50:49 dovecot_login authenticator failed for ([106.3.140.29]) [106.3.140.29]:57088: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.135
country_id: 1835841
description:
2025-07-13 12:51:03 dovecot_login authenticator failed for ([112.172.126.135]) [112.172.126.135]:51432: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.23
country_id: 99237
description:
2025-07-13 12:52:21 dovecot_login authenticator failed for ([65.20.193.23]) [65.20.193.23]:41219: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.87.21.146
country_id: 1814991
description:
2025-07-13 12:52:41 dovecot_login authenticator failed for ([218.87.21.146]) [218.87.21.146]:58817: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 12:52:45 servidor sshd[202576]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 12:52:45 servidor sshd[202576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 12:53:11 servidor sshd[202660]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.130.113.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 12:53:11 servidor sshd[202660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.130.113.204  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 12:53:13 servidor sshd[202660]: Failed password for root from 125.130.113.204 port 42204 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 13:01:24 -0300] info [cpaneld] 185.243.96.5 - Robert "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Robert (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.169.204.193
country_id: 3469034
description:
Jul 13 13:04:43 servidor sshd[207201]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.169.204.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.169.204.193
country_id: 3469034
description:
Jul 13 13:04:43 servidor sshd[207201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.169.204.193


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 13:06:07 servidor sshd[208468]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.173.178
country_id: 1210997
description:
Jul 13 13:06:58 servidor sshd[208604]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.84.173.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.84.173.178
country_id: 1210997
description:
Jul 13 13:06:58 servidor sshd[208604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.84.173.178  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 13:10:36 servidor sshd[209496]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 13:10:36 servidor sshd[209496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 164.52.24.187
country_id: 1861060
description:
Jul 13 13:13:20 servidor dovecot[183307]: pop3-login: Disconnected: Aborted login by logging out (tried to use unsupported auth mechanism): user=<>, method=NTLM, rip=164.52.24.187, lip=69.30.198.27, TLS, session=<jhVf0tE5I9GkNBi7>


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 13:15:02 servidor sshd[211094]: pam_imunify(sshd:auth): [IM360_RBL] The IP 1.226.84.145 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 13:15:02 servidor sshd[211094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.226.84.145  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.197.150.37
country_id: 3057568
description:
2025-07-13 13:14:34 dovecot_login authenticator failed for static-dsl-37.87-197-150.telecom.sk [87.197.150.37]:56685: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-07-13 13:14:48 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:56094: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 13:14:59 servidor sshd[211089]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 13:14:59 servidor sshd[211089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.122.238
country_id: 2921044
description:
Jul 13 13:16:44 servidor sshd[212316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.122.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.122.238
country_id: 2921044
description:
Jul 13 13:16:44 servidor sshd[212316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.122.238  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.47.173.124
country_id: 2921044
description:
Jul 13 13:17:20 servidor sshd[212454]: pam_imunify(sshd:auth): [IM360_RBL] The IP 78.47.173.124 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.47.173.124
country_id: 2921044
description:
Jul 13 13:17:20 servidor sshd[212454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.47.173.124


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 13:20:19 servidor sshd[213262]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:20:35 servidor sshd[213270]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.176.78.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:20:35 servidor sshd[213270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.176.78.178


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:22:05 servidor sshd[213495]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:22:05 servidor sshd[213495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.127  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.77.99
country_id: 2921044
description:
Jul 13 13:23:27 servidor sshd[213759]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.220.77.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.220.77.99
country_id: 2921044
description:
Jul 13 13:23:27 servidor sshd[213759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.220.77.99


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.235.86.152
country_id: 798544
description:
Jul 13 13:24:47 servidor sshd[214083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.235.86.152  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 13:24:21 servidor sshd[214046]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 13:24:21 servidor sshd[214046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.235.86.152
country_id: 798544
description:
Jul 13 13:24:47 servidor sshd[214083]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.235.86.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.77.162
country_id: 878675
description:
Jul 13 13:25:16 servidor sshd[214293]: pam_imunify(sshd:auth): [IM360_RBL] The IP 41.78.77.162 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.78.77.162
country_id: 878675
description:
Jul 13 13:25:16 servidor sshd[214293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.78.77.162


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:25:42 servidor sshd[214400]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.176.78.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:25:42 servidor sshd[214400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.176.78.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-07-13 13:26:36 dovecot_login authenticator failed for ([61.0.236.99]) [182.72.143.2]:42136: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.4.208.216
country_id: 1605651
description:
Jul 13 13:26:43 servidor sshd[214566]: pam_imunify(sshd:auth): [IM360_RBL] The IP 171.4.208.216 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 171.4.208.216
country_id: 1605651
description:
Jul 13 13:26:43 servidor sshd[214566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.4.208.216


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.114.162
country_id: 1269750
description:
2025-07-13 13:26:53 dovecot_login authenticator failed for ([182.95.114.162]) [182.95.114.162]:56134: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 13:26:11 servidor sshd[214462]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 13:26:11 servidor sshd[214462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 13:27:56 servidor sshd[214795]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:27:07 servidor sshd[214626]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.176.78.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:27:07 servidor sshd[214626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.176.78.178


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:27:09 servidor sshd[214626]: Failed password for invalid user test from 103.176.78.178 port 42154 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 13:28:45 -0300] info [cpaneld] 185.243.96.5 - Joseph "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Joseph (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:28:59 servidor sshd[214970]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:28:59 servidor sshd[214970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.127  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.12.204.239
country_id: 2960313
description:
Jul 13 13:29:28 servidor sshd[215212]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.12.204.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.12.204.239
country_id: 2960313
description:
Jul 13 13:29:28 servidor sshd[215212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.12.204.239  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 13:32:23 servidor sshd[216596]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 13:32:23 servidor sshd[216596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.153.34
country_id: 3017382
description:
Jul 13 13:33:54 servidor sshd[216863]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.77.153.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.77.153.34
country_id: 3017382
description:
Jul 13 13:33:54 servidor sshd[216863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.153.34  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.114.45.37
country_id: 2921044
description:
Jul 13 13:33:20 servidor sshd[216776]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.114.45.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.114.45.37
country_id: 2921044
description:
Jul 13 13:33:20 servidor sshd[216776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.114.45.37  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 13:34:11 servidor sshd[217052]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.131.12.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 13:34:11 servidor sshd[217052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.131.12.238  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 13:37:14 servidor sshd[217735]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 13:37:14 servidor sshd[217735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.77.222.24
country_id: 3017382
description:
Jul 13 13:37:47 servidor sshd[217883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.222.24


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.26.186
country_id: 878675
description:
2025-07-13 13:38:10 dovecot_login authenticator failed for ([41.220.26.186]) [41.220.26.186]:44214: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.120.106
country_id: 1814991
description:
2025-07-13 13:38:43 dovecot_login authenticator failed for ([124.67.120.106]) [124.67.120.106]:46403: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
country_id: 1835841
description:
Jul 13 13:38:52 servidor sshd[218169]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
country_id: 1835841
description:
Jul 13 13:38:52 servidor sshd[218169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 221.156.137.104
country_id: 1835841
description:
Jul 13 13:38:53 servidor sshd[218169]: Failed password for root from 221.156.137.104 port 35124 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 13:39:11 servidor sshd[218371]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 13:39:11 servidor sshd[218371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.141.31.119
country_id: 1814991
description:
Jul 13 13:39:58 servidor sshd[218557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.141.31.119  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
country_id: 1835841
description:
Jul 13 13:46:35 servidor sshd[5621]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
country_id: 1835841
description:
Jul 13 13:46:35 servidor sshd[5621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.20.18.85
country_id: 617790
description:
Jul 13 13:48:21 servidor sshd[6018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.20.18.85


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2025-07-13 13:49:54 dovecot_login authenticator failed for 217.42.246.220.static.netvigator.com [220.246.42.217]:63827: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.136.243
country_id: 1562822
description:
2025-07-13 13:50:09 dovecot_login authenticator failed for ([45.118.136.243]) [45.118.136.243]:58841: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.30
country_id: 1269750
description:
Jul 13 13:54:22 servidor sshd[7686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.30  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:54:39 servidor sshd[7973]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:54:39 servidor sshd[7973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.127  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.4.103.61
country_id: 1168579
description:
2025-07-13 13:56:19 dovecot_login authenticator failed for ([103.4.103.61]) [103.4.103.61]:33058: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 13:56:28 -0300] info [cpaneld] 185.243.96.5 - William "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user William (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.188.56.8
country_id: 2017370
description:
2025-07-13 13:56:43 dovecot_login authenticator failed for ([94.188.56.8]) [94.188.56.8]:49218: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
country_id: 294640
description:
2025-07-13 13:58:04 dovecot_login authenticator failed for ([85.159.164.28]) [85.159.164.28]:60720: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.247.160.143
country_id: 2921044
description:
Jul 13 13:58:25 servidor sshd[9652]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.247.160.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-07-13 13:58:57 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:57492: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
country_id: 1835841
description:
Jul 13 13:58:19 servidor sshd[9635]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
country_id: 1835841
description:
Jul 13 13:58:19 servidor sshd[9635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.247.160.143
country_id: 2921044
description:
Jul 13 13:58:25 servidor sshd[9652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.247.160.143


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.175.4
country_id: 1562822
description:
Jul 13 13:58:27 servidor sshd[9657]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.191.175.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.191.175.4
country_id: 1562822
description:
Jul 13 13:58:27 servidor sshd[9657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.191.175.4  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.30
country_id: 1269750
description:
Jul 13 13:58:29 servidor sshd[9663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.30  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.243.183
country_id: 1562822
description:
2025-07-13 13:58:45 dovecot_login authenticator failed for ([14.224.208.174]) [27.74.243.183]:36898: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.30
country_id: 1269750
description:
Jul 13 13:59:56 servidor sshd[10050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.30  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 13:59:27 servidor sshd[9950]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 13:59:27 servidor sshd[9950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 14:00:26 servidor sshd[10342]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 14:00:26 servidor sshd[10342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 14:00:28 servidor sshd[10342]: Failed password for redestreamhost from 82.151.65.155 port 41876 ssh2


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 14:01:19 servidor sshd[10528]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 14:01:38 servidor sshd[10588]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 14:01:38 servidor sshd[10588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.127  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.118.48.136
country_id: 1562822
description:
Jul 13 14:09:10 servidor sshd[12199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.118.48.136  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 14:10:45 servidor sshd[12722]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 14:10:45 servidor sshd[12722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.201.4.38
country_id: 458258
description:
Jul 13 14:13:14 servidor sshd[14243]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.201.4.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 89.201.4.38
country_id: 458258
description:
Jul 13 14:13:14 servidor sshd[14243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.201.4.38  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.158.60.90
country_id: 3017382
description:
Jul 13 14:13:52 servidor sshd[14384]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.158.60.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.158.60.90
country_id: 3017382
description:
Jul 13 14:13:52 servidor sshd[14384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.60.90


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 14:15:09 servidor sshd[14874]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 14:15:09 servidor sshd[14874]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.83.126
country_id: 3469034
description:
Jul 13 14:14:40 servidor sshd[14482]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.36.83.126 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.36.83.126
country_id: 3469034
description:
Jul 13 14:14:40 servidor sshd[14482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.36.83.126


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.111.118
country_id: 1562822
description:
Jul 13 14:15:24 servidor sshd[14920]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.95.111.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.95.111.118
country_id: 1562822
description:
Jul 13 14:15:24 servidor sshd[14920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.111.118  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.138.59.242
country_id: 6252001
description:
Jul 13 14:23:40 servidor sshd[16695]: pam_imunify(sshd:auth): [IM360_RBL] The IP 174.138.59.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 174.138.59.242
country_id: 6252001
description:
Jul 13 14:23:40 servidor sshd[16695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.59.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 14:24:38 -0300] info [cpaneld] 185.243.96.5 - Jason "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Jason (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 14:25:55 servidor sshd[17450]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.120.215
country_id: 1814991
description:
Jul 13 14:26:57 servidor sshd[17782]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.120.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.120.215
country_id: 1814991
description:
Jul 13 14:26:57 servidor sshd[17782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.120.215  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 14:27:24 servidor sshd[17915]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 14:27:24 servidor sshd[17915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.127  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
country_id: 1562822
description:
Jul 13 14:27:29 servidor sshd[17928]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
country_id: 1562822
description:
Jul 13 14:27:29 servidor sshd[17928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-07-13 14:29:02 dovecot_login authenticator failed for ([103.203.210.119]) [103.203.210.119]:34597: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.74.9.190
country_id: 1814991
description:
2025-07-13 14:29:15 dovecot_login authenticator failed for ([101.230.0.49]) [124.74.9.190]:56916: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 14:29:44 servidor sshd[19334]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 14:29:44 servidor sshd[19334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 14:32:33 servidor sshd[20390]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 14:32:33 servidor sshd[20390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.65.121.222
country_id: 3017382
description:
Jul 13 14:33:58 servidor sshd[20666]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.65.121.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.65.121.222
country_id: 3017382
description:
Jul 13 14:33:58 servidor sshd[20666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.65.121.222  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.128.112.74
country_id: 732800
description:
Jul 13 14:34:45 servidor sshd[20834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.128.112.74


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.164
country_id: 6252001
description:
Jul 13 14:36:16 servidor sshd[21409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.164


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.148.77.164
country_id: 6252001
description:
Jul 13 14:36:18 servidor sshd[21409]: Failed password for invalid user test from 132.148.77.164 port 50438 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.148.77.164
country_id: 6252001
description:
Jul 13 14:36:16 servidor sshd[21409]: pam_imunify(sshd:auth): [IM360_RBL] The IP 132.148.77.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.60.252.70
country_id: 2921044
description:
Jul 13 14:38:22 servidor sshd[22003]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.60.252.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.60.252.70
country_id: 2921044
description:
Jul 13 14:38:22 servidor sshd[22003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.60.252.70


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.213.120.14
country_id: 2921044
description:
Jul 13 14:40:28 servidor sshd[22552]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.213.120.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 89.213.120.14
country_id: 2921044
description:
Jul 13 14:40:28 servidor sshd[22552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.213.120.14


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:40:43 servidor sshd[22568]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.250.72.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:40:43 servidor sshd[22568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.250.72.168  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:41:53 servidor sshd[22776]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.176.12.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:41:53 servidor sshd[22776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.176.12.6  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 14:42:36 servidor sshd[23054]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.38.121.43
country_id: 1835841
description:
Jul 13 14:42:52 servidor sshd[23516]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.38.121.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.38.121.43
country_id: 1835841
description:
Jul 13 14:42:52 servidor sshd[23516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.38.121.43  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
country_id: 3996063
description:
Jul 13 14:43:52 servidor sshd[24169]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
country_id: 3996063
description:
Jul 13 14:43:52 servidor sshd[24169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.112.100
country_id: 1814991
description:
Jul 13 14:43:27 servidor sshd[24138]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.112.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.112.100
country_id: 1814991
description:
Jul 13 14:43:27 servidor sshd[24138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.112.100  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:44:34 servidor sshd[24320]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.250.72.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:44:34 servidor sshd[24320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.250.72.168  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.240.229.18
country_id: 2264397
description:
2025-07-13 14:45:19 dovecot_login authenticator failed for bl7-229-18.dsl.telepac.pt [85.240.229.18]:58706: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.15.163.18
country_id: 6252001
description:
2025-07-13 14:45:37 dovecot_login authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:59443: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:45:43 servidor sshd[24644]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.176.12.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:45:43 servidor sshd[24644]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.176.12.6  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:45:51 servidor sshd[24672]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.250.72.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:45:51 servidor sshd[24672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.250.72.168  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:46:47 servidor sshd[24857]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.176.12.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:46:47 servidor sshd[24857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.176.12.6  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 14:47:49 servidor sshd[25207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.37


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 14:49:46 servidor sshd[25571]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 14:53:02 -0300] info [cpaneld] 185.243.96.5 - Andrew "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Andrew (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.112.100
country_id: 1814991
description:
Jul 13 14:53:20 servidor sshd[26488]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.112.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.112.100
country_id: 1814991
description:
Jul 13 14:53:20 servidor sshd[26488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.112.100  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 14:54:44 servidor sshd[26750]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 14:54:44 servidor sshd[26750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.241.125.180
country_id: 6252001
description:
Jul 13 14:56:15 servidor sshd[27330]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.241.125.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.241.125.180
country_id: 6252001
description:
Jul 13 14:56:15 servidor sshd[27330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.125.180


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 14:58:36 servidor sshd[28910]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.153.241
country_id: 1880251
description:
Jul 13 14:58:19 servidor sshd[28808]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.153.241 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.153.241
country_id: 1880251
description:
Jul 13 14:58:19 servidor sshd[28808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.153.241  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.112.100
country_id: 1814991
description:
Jul 13 15:00:02 servidor sshd[29093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.112.100  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.26.96.232
country_id: 6252001
description:
Jul 13 15:00:24 servidor sshd[29360]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.26.96.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.26.96.232
country_id: 6252001
description:
Jul 13 15:00:24 servidor sshd[29360]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.26.96.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.57.174
country_id: 1835841
description:
2025-07-13 15:00:35 dovecot_login authenticator failed for ([59.7.57.174]) [59.7.57.174]:55528: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.86.148.38
country_id: 1814991
description:
2025-07-13 15:01:18 dovecot_login authenticator failed for ([223.86.148.38]) [223.86.148.38]:29350: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.87.128
country_id: 2921044
description:
Jul 13 15:01:29 servidor sshd[29555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.87.128  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 15:05:47 servidor sshd[30575]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 15:05:47 servidor sshd[30575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 15:06:19 servidor sshd[30666]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 15:06:19 servidor sshd[30666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.103.34.243
country_id: 298795
description:
Jul 13 15:07:41 servidor sshd[30919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.103.34.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.103.34.243
country_id: 298795
description:
Jul 13 15:07:41 servidor sshd[30919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.103.34.243  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.196.204.223
country_id: 3017382
description:
Jul 13 15:09:06 servidor sshd[31534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.196.204.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.196.204.223
country_id: 3017382
description:
Jul 13 15:09:06 servidor sshd[31534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.204.223


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 15:08:19 servidor sshd[31252]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 15:08:19 servidor sshd[31252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-07-13 15:13:01 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:33270: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 15:13:49 servidor sshd[33842]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.216.193.28
country_id: 1835841
description:
2025-07-13 15:13:19 dovecot_login authenticator failed for ([211.216.193.28]) [211.216.193.28]:28921: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.212.103.171
country_id: 798549
description:
Jul 13 15:13:25 servidor sshd[33750]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.212.103.171 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.212.103.171
country_id: 798549
description:
Jul 13 15:13:25 servidor sshd[33750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.212.103.171  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.12.247.56
country_id: 2750405
description:
Jul 13 15:14:24 servidor sshd[34050]: pam_imunify(sshd:auth): [IM360_RBL] The IP 149.12.247.56 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 149.12.247.56
country_id: 2750405
description:
Jul 13 15:14:24 servidor sshd[34050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.12.247.56  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.90.222.0
country_id: 2921044
description:
Jul 13 15:16:03 servidor sshd[34591]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.90.222.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.90.222.0
country_id: 2921044
description:
Jul 13 15:16:03 servidor sshd[34591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.90.222.0


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.167.66.226
country_id: 6252001
description:
Jul 13 15:18:46 servidor sshd[35067]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.167.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.167.66.226
country_id: 6252001
description:
Jul 13 15:18:46 servidor sshd[35067]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.167.66.226  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 15:19:24 servidor sshd[35253]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 15:19:24 servidor sshd[35253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.61.162.81
country_id: 6252001
description:
Jul 13 15:19:25 servidor sshd[35257]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.61.162.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.61.162.81
country_id: 6252001
description:
Jul 13 15:19:25 servidor sshd[35257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.61.162.81


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 15:20:49 -0300] info [cpaneld] 185.243.96.5 - Ryan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Ryan (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.110.157.47
country_id: 2750405
description:
Jul 13 15:21:21 servidor sshd[35897]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.110.157.47 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.110.157.47
country_id: 2750405
description:
Jul 13 15:21:21 servidor sshd[35897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.110.157.47  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 15:22:30 servidor sshd[36104]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.71
country_id: 99237
description:
2025-07-13 15:24:24 dovecot_login authenticator failed for ([65.20.129.71]) [65.20.129.71]:38431: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
country_id: 6252001
description:
2025-07-13 15:24:41 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:48324: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:27:28 servidor sshd[37305]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.42.133.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:27:28 servidor sshd[37305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.42.133.43


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.170.129.195
country_id: 1605651
description:
Jul 13 15:27:54 servidor sshd[38270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.170.129.195


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 15:28:18 servidor sshd[38409]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.130.95.240
country_id: 1835841
description:
Jul 13 15:28:26 servidor sshd[38413]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.130.95.240 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.130.95.240
country_id: 1835841
description:
Jul 13 15:28:26 servidor sshd[38413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.130.95.240


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 15:28:43 servidor sshd[38652]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 15:28:43 servidor sshd[38652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.96.243.157
country_id: 1512440
description:
Jul 13 15:29:25 servidor sshd[38847]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.96.243.157 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.96.243.157
country_id: 1512440
description:
Jul 13 15:29:25 servidor sshd[38847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.96.243.157  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:30:12 servidor sshd[39274]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.42.133.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:30:12 servidor sshd[39274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.42.133.43


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul 13 15:30:24 servidor dovecot[39428]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:30:15 servidor sshd[39274]: Disconnected from invalid user runcloud 111.42.133.43 port 26789 [preauth]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:31:51 servidor sshd[40630]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.42.133.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:31:51 servidor sshd[40630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.42.133.43


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:31:52 servidor sshd[40630]: Failed password for invalid user builder from 111.42.133.43 port 26804 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 13 15:32:52 servidor sshd[40885]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.65 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 13 15:32:52 servidor sshd[40885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.65  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.91.112
country_id: 1880251
description:
Jul 13 15:33:52 servidor sshd[41104]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.172.91.112 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.172.91.112
country_id: 1880251
description:
Jul 13 15:33:52 servidor sshd[41104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.91.112  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.180.255.136
country_id: 6252001
description:
Jul 13 15:35:14 servidor sshd[41558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.180.255.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.180.255.136
country_id: 6252001
description:
Jul 13 15:35:14 servidor sshd[41558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.180.255.136


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.180.255.136
country_id: 6252001
description:
Jul 13 15:35:16 servidor sshd[41558]: Failed password for invalid user perl from 5.180.255.136 port 35302 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.76.166.65
country_id: 1814991
description:
Jul 13 15:35:43 servidor sshd[41724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.166.65  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
country_id: 1835841
description:
2025-07-13 15:35:45 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:33384: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-07-13 15:35:59 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:44750: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.76.166.65
country_id: 1814991
description:
Jul 13 15:36:22 servidor sshd[41863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.166.65  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.12.247.25
country_id: 2750405
description:
Jul 13 15:38:20 servidor sshd[42276]: pam_imunify(sshd:auth): [IM360_RBL] The IP 149.12.247.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 15:39:00 servidor sshd[42359]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 15:39:00 servidor sshd[42359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.50.177.48
country_id: 1562822
description:
Jul 13 15:38:52 servidor sshd[42315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.50.177.48  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.144.234
country_id: 3469034
description:
Jul 13 15:38:56 servidor sshd[42323]: pam_imunify(sshd:auth): [IM360_RBL] The IP 168.196.144.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 168.196.144.234
country_id: 3469034
description:
Jul 13 15:38:56 servidor sshd[42323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.196.144.234


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 149.12.247.25
country_id: 2750405
description:
Jul 13 15:38:20 servidor sshd[42276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.12.247.25  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.50.177.48
country_id: 1562822
description:
Jul 13 15:38:52 servidor sshd[42315]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.50.177.48 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 15:42:52 servidor sshd[43395]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 15:45:07 servidor sshd[44198]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.108.192
country_id: 3017382
description:
Jul 13 15:44:20 servidor sshd[43757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.108.192  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.130.255.8
country_id: 1643084
description:
Jul 13 15:44:32 servidor sshd[43975]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.130.255.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.108.192
country_id: 3017382
description:
Jul 13 15:44:20 servidor sshd[43757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.108.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.130.255.8
country_id: 1643084
description:
Jul 13 15:44:32 servidor sshd[43975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.130.255.8


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 15:45:07 servidor sshd[44198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.23.54
country_id: 2635167
description:
Jul 13 15:47:13 servidor sshd[45655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.23.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.23.54
country_id: 2635167
description:
Jul 13 15:47:13 servidor sshd[45655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.23.54


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 15:47:32 servidor sshd[45751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.81


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 15:47:32 servidor sshd[45751]: Invalid user radiomusicclassicsfm from 92.118.39.81 port 34732


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 15:47:32 servidor sshd[45751]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 15:49:23 -0300] info [cpaneld] 185.243.96.5 - Anthony "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Anthony (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.152.138.9
country_id: 1643084
description:
Jul 13 15:51:00 servidor sshd[46502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.152.138.9  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.53.253.2
country_id: 1814991
description:
Jul 13 15:51:23 servidor sshd[46626]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.53.253.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.53.253.2
country_id: 1814991
description:
Jul 13 15:51:23 servidor sshd[46626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.53.253.2  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 15:55:55 servidor sshd[47649]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2025-07-13 15:55:45 dovecot_login authenticator failed for ([39.125.67.109]) [39.125.67.109]:57355: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
country_id: 1814991
description:
2025-07-13 15:56:11 dovecot_login authenticator failed for ([111.53.129.92]) [111.53.129.92]:36284: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.123.153.214
country_id: 1814991
description:
2025-07-13 15:56:40 dovecot_login authenticator failed for ([144.123.153.214]) [144.123.153.214]:42032: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 15:57:09 servidor sshd[48229]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 15:57:09 servidor sshd[48229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34  user=mumbacafm


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 15:57:13 servidor sshd[48235]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 15:57:13 servidor sshd[48235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.234.220.212
country_id: 6252001
description:
Jul 13 15:56:48 servidor sshd[47817]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.234.220.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.234.220.212
country_id: 6252001
description:
Jul 13 15:56:48 servidor sshd[47817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.234.220.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.108.124
country_id: 1819730
description:
2025-07-13 15:57:00 dovecot_login authenticator failed for ([45.251.108.124]) [45.251.108.124]:51129: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 15:57:11 servidor sshd[48229]: Failed password for mumbacafm from 92.118.39.34 port 41118 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.89.127.232
country_id: 2921044
description:
Jul 13 15:57:35 servidor sshd[48343]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.89.127.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.89.127.232
country_id: 2921044
description:
Jul 13 15:57:35 servidor sshd[48343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.89.127.232  user=root


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 86.54.31.38
country_id: 6251999
description:
Jul 13 15:57:36 servidor dovecot[39435]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 4 secs): user=<>, rip=86.54.31.38, lip=69.30.198.26, TLS, session=<K5jYHdQ5NuBWNh8m>


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.169.226.134
country_id: 6252001
description:
Jul 13 15:59:28 servidor sshd[48750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.226.134


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.226.134
country_id: 6252001
description:
Jul 13 15:59:28 servidor sshd[48750]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.169.226.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.67.208.20
country_id: 6252001
description:
Jul 13 16:01:55 servidor sshd[50240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.67.208.20  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
country_id: 1835841
description:
Jul 13 16:01:29 servidor sshd[50213]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
country_id: 1835841
description:
Jul 13 16:01:29 servidor sshd[50213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:02:59 servidor sshd[50592]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.85.152.42 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:02:59 servidor sshd[50592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.85.152.42  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:03:21 servidor sshd[50668]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.23.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:03:21 servidor sshd[50668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.23.51  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.105.56
country_id: 1814991
description:
Jul 13 16:03:39 servidor sshd[50740]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.105.56 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.105.56
country_id: 1814991
description:
Jul 13 16:03:39 servidor sshd[50740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.105.56  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.224.115.232
country_id: 1814991
description:
Jul 13 16:05:13 servidor sshd[51109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.224.115.232  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:06:06 servidor sshd[51275]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.13.244.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:06:06 servidor sshd[51275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.13.244.219  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:05:22 servidor sshd[51145]: pam_imunify(sshd:auth): [IM360_RBL] The IP 123.58.209.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:05:22 servidor sshd[51145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.58.209.115  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:07:14 servidor sshd[51498]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.85.152.42 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:06:43 servidor sshd[51378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.213.64  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:07:02 servidor sshd[51477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.23.51  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:07:11 servidor sshd[51484]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:07:11 servidor sshd[51484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.95  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:06:43 servidor sshd[51378]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.213.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:07:02 servidor sshd[51477]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.23.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:07:14 servidor sshd[51498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.85.152.42  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:07:55 servidor sshd[51609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.58.209.115  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:08:08 servidor sshd[51801]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.13.244.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:08:08 servidor sshd[51801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.13.244.219  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:08:08 servidor sshd[51803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.23.51  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.156.22.114
country_id: 798549
description:
Jul 13 16:07:52 servidor sshd[51604]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.156.22.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.156.22.114
country_id: 798549
description:
Jul 13 16:07:52 servidor sshd[51604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.156.22.114


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:07:55 servidor sshd[51609]: pam_imunify(sshd:auth): [IM360_RBL] The IP 123.58.209.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:08:08 servidor sshd[51803]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.23.51 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:08:58 servidor sshd[52024]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:08:41 servidor sshd[51953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.95  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:08:45 servidor sshd[51957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.85.152.42  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:09:02 servidor sshd[52070]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.213.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:08:45 servidor sshd[51957]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.85.152.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:08:41 servidor sshd[51953]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.95 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.236.46
country_id: 1643084
description:
[2025-07-13 16:08:59 -0300] info [whostmgrd] 103.65.236.46 - distakec "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:09:02 servidor sshd[52070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.213.64  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:09:13 servidor sshd[52085]: pam_imunify(sshd:auth): [IM360_RBL] The IP 123.58.209.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:09:13 servidor sshd[52085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.58.209.115  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:09:30 servidor sshd[52169]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.13.244.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:09:30 servidor sshd[52169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.13.244.219  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:09:55 servidor sshd[52312]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:09:55 servidor sshd[52312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.95  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.224.115.232
country_id: 1814991
description:
Jul 13 16:09:57 servidor sshd[52314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.224.115.232  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:10:33 servidor sshd[52640]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.224.115.232
country_id: 1814991
description:
Jul 13 16:10:50 servidor sshd[52712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.224.115.232  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.248.200.76
country_id: 2750405
description:
2025-07-13 16:11:43 dovecot_login authenticator failed for ([104.248.200.76]) [104.248.200.76]:38728: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.241.234
country_id: 1814991
description:
2025-07-13 16:11:56 dovecot_login authenticator failed for ([210.22.130.22]) [58.246.241.234]:50103: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:11:56 servidor sshd[52944]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.213.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:11:56 servidor sshd[52944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.213.64  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.244.35
country_id: 1562822
description:
Jul 13 16:15:30 servidor sshd[55431]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.212.244.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.244.35
country_id: 1562822
description:
Jul 13 16:15:30 servidor sshd[55431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.244.35


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 24.144.87.77
country_id: 6252001
description:
Jul 13 16:15:33 servidor sshd[55434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.144.87.77


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.105.56
country_id: 1814991
description:
Jul 13 16:16:03 servidor sshd[55461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.105.56  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 16:16:32 servidor sshd[55599]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 16:16:32 servidor sshd[55599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.208.9.124
country_id: 2750405
description:
Jul 13 16:16:50 servidor sshd[55633]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.208.9.124 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.208.9.124
country_id: 2750405
description:
Jul 13 16:16:50 servidor sshd[55633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.208.9.124


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 16:17:59 -0300] info [cpaneld] 185.243.96.5 - Jacob "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Jacob (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.105.56
country_id: 1814991
description:
Jul 13 16:18:51 servidor sshd[56123]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.105.56 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.105.56
country_id: 1814991
description:
Jul 13 16:18:51 servidor sshd[56123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.105.56  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.206.12.13
country_id: 1835841
description:
Jul 13 16:19:20 servidor sshd[56297]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.206.12.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.206.12.13
country_id: 1835841
description:
Jul 13 16:19:20 servidor sshd[56297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.206.12.13


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.234.220.213
country_id: 6252001
description:
Jul 13 16:19:23 servidor sshd[56301]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.234.220.213 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.234.220.213
country_id: 6252001
description:
Jul 13 16:19:23 servidor sshd[56301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.234.220.213  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:21:37 servidor sshd[56814]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.70.149.210
country_id: 1814991
description:
2025-07-13 16:21:42 dovecot_login authenticator failed for ([223.70.149.210]) [223.70.149.210]:37874: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-07-13 16:22:00 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:39718: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.108
country_id: 732800
description:
Jul 13 16:24:55 servidor sshd[57489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.108  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 13 16:24:37 servidor sshd[57447]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.65 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 13 16:24:37 servidor sshd[57447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.65  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.167.38.134
country_id: 6252001
description:
Jul 13 16:25:44 servidor sshd[57862]: pam_imunify(sshd:auth): [IM360_RBL] The IP 72.167.38.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 72.167.38.134
country_id: 6252001
description:
Jul 13 16:25:44 servidor sshd[57862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.38.134


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.126.101.102
country_id: 6252001
description:
Jul 13 16:27:56 servidor sshd[58230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.126.101.102  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 16:30:54 servidor sshd[60013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 16:30:54 servidor sshd[60013]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.36.253
country_id: 2921044
description:
Jul 13 16:37:33 servidor sshd[61451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.36.253


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.36.253
country_id: 2921044
description:
Jul 13 16:37:33 servidor sshd[61451]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.36.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 16:39:42 servidor sshd[62122]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.130.113.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 16:39:42 servidor sshd[62122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.130.113.204  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.74.235.208
country_id: 6252001
description:
2025-07-13 16:40:01 dovecot_login authenticator failed for syn-074-074-235-208.res.spectrum.com [74.74.235.208]:49382: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
country_id: 2661886
description:
2025-07-13 16:40:18 dovecot_login authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:34088: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.128.112.74
country_id: 732800
description:
Jul 13 16:40:44 servidor sshd[62575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.128.112.74


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:43:21 servidor sshd[63010]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.21.215
country_id: 2750405
description:
Jul 13 16:45:29 servidor sshd[64621]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.21.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.21.215
country_id: 2750405
description:
Jul 13 16:45:29 servidor sshd[64621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.21.215


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 16:46:37 servidor sshd[64870]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 16:46:37 servidor sshd[64870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 16:46:38 -0300] info [cpaneld] 185.243.96.5 - Nicholas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Nicholas (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:47:17 servidor sshd[64977]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.102.63
country_id: 1880251
description:
Jul 13 16:47:33 servidor sshd[64991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.102.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.102.63
country_id: 1880251
description:
Jul 13 16:47:33 servidor sshd[64991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.102.63


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 16:47:58 servidor sshd[65083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.99.243
country_id: 1880251
description:
Jul 13 16:48:17 servidor sshd[65174]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.99.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.99.243
country_id: 1880251
description:
Jul 13 16:48:17 servidor sshd[65174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.99.243


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.180.141.230
country_id: 3658394
description:
[2025-07-13 16:49:35 -0300] info [whostmgrd] 45.180.141.230 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-07-13 16:51:48 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:53986: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.65.62.234
country_id: 3686110
description:
2025-07-13 16:51:33 dovecot_login authenticator failed for ([190.65.62.235]) [190.65.62.234]:62348: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.202.236.219
country_id: 2921044
description:
Jul 13 16:51:45 servidor sshd[66024]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.202.236.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.202.236.219
country_id: 2921044
description:
Jul 13 16:51:45 servidor sshd[66024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.202.236.219


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
country_id: 2510769
description:
Jul 13 16:52:23 servidor sshd[66106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 16:52:50 servidor sshd[66186]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 16:52:50 servidor sshd[66186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
country_id: 2510769
description:
Jul 13 16:52:23 servidor sshd[66106]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:59:47 servidor sshd[67692]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.18.215
country_id: 3017382
description:
Jul 13 16:59:43 servidor sshd[67683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.18.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.18.215
country_id: 3017382
description:
Jul 13 16:59:43 servidor sshd[67683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.18.215  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.1.60.243
country_id: 1605651
description:
Jul 13 17:01:50 servidor sshd[69579]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.1.60.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.1.60.243
country_id: 1605651
description:
Jul 13 17:01:50 servidor sshd[69579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.1.60.243


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 17:01:59 servidor sshd[69645]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 17:01:59 servidor sshd[69645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-07-13 17:02:14 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:60409: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.0.192.86
country_id: 2017370
description:
2025-07-13 17:02:31 dovecot_login authenticator failed for (46x0x192x86.static-customer.samara.ertelecom.ru) [46.0.192.86]:60948: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 17:07:04 servidor sshd[70833]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 17:07:04 servidor sshd[70833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101  user=root


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.109
country_id: 2635167
description:
Jul 13 17:08:13 servidor dovecot[39435]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.109, lip=69.30.198.26, TLS, session=<VAdiGtU5f8NX7LBt>


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.137.243
country_id: 3017382
description:
Jul 13 17:08:07 servidor sshd[71057]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.178.137.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.178.137.243
country_id: 3017382
description:
Jul 13 17:08:07 servidor sshd[71057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.137.243  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 17:11:47 servidor sshd[71791]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.88.9
country_id: 1880251
description:
Jul 13 17:11:29 servidor sshd[71756]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.88.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.88.9
country_id: 1880251
description:
Jul 13 17:11:29 servidor sshd[71756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.88.9


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 17:12:51 servidor sshd[72121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.131.12.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 17:12:51 servidor sshd[72121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.131.12.238  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.166
country_id: 1814991
description:
2025-07-13 17:13:44 dovecot_login authenticator failed for ([1.31.80.166]) [1.31.80.166]:36402: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.51.50
country_id: 953987
description:
2025-07-13 17:14:00 dovecot_login authenticator failed for (102.221.51.50) [102.221.51.50]:48520: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.130.219.128
country_id: 1562822
description:
Jul 13 17:14:22 servidor sshd[72473]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.130.219.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.130.219.128
country_id: 1562822
description:
Jul 13 17:14:22 servidor sshd[72473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.219.128  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 17:15:16 -0300] info [cpaneld] 185.243.96.5 - Brian "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Brian (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 17:15:32 servidor sshd[73826]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 17:15:32 servidor sshd[73826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.115  user=mumbacafm


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 17:15:34 servidor sshd[73826]: Failed password for mumbacafm from 92.118.39.115 port 51782 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.151.53
country_id: 953987
description:
Jul 13 17:15:43 servidor sshd[73868]: pam_imunify(sshd:auth): [IM360_RBL] The IP 197.242.151.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 197.242.151.53
country_id: 953987
description:
Jul 13 17:15:43 servidor sshd[73868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.242.151.53  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-07-13 17:19:35 dovecot_login authenticator failed for ([213.230.64.246]) [213.230.64.246]:35674: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.23
country_id: 99237
description:
2025-07-13 17:20:00 dovecot_login authenticator failed for ([65.20.193.23]) [65.20.193.23]:48735: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 17:20:37 servidor sshd[74973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.77.162
country_id: 878675
description:
Jul 13 17:20:37 servidor sshd[74971]: pam_imunify(sshd:auth): [IM360_RBL] The IP 41.78.77.162 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.78.77.162
country_id: 878675
description:
Jul 13 17:20:37 servidor sshd[74971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.78.77.162  user=ftp


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 17:20:31 servidor sshd[74942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 17:20:37 servidor sshd[74973]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 17:20:25 servidor sshd[74921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 17:20:31 servidor sshd[74942]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 17:22:34 servidor sshd[75334]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.161.62.169
country_id: 6252001
description:
Jul 13 17:26:10 servidor sshd[76306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.161.62.169  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 17:27:39 servidor sshd[76828]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 17:27:39 servidor sshd[76828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.130.221
country_id: 6252001
description:
Jul 13 17:28:00 servidor sshd[76854]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.130.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.130.221
country_id: 6252001
description:
Jul 13 17:28:00 servidor sshd[76854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.130.221  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2025-07-13 17:28:26 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:43325: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.227.238.172
country_id: 6252001
description:
2025-07-13 17:28:38 dovecot_login authenticator failed for ([50.227.238.172]) [50.227.238.172]:43179: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 17:30:25 servidor sshd[78312]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 17:30:25 servidor sshd[78312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 17:31:18 servidor sshd[78869]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 17:33:17 servidor sshd[79283]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.38.102
country_id: 1562822
description:
Jul 13 17:33:58 servidor sshd[79526]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.38.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.38.102
country_id: 1562822
description:
Jul 13 17:33:58 servidor sshd[79526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.38.102


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.203.212
country_id: 1643084
description:
Jul 13 17:37:58 servidor sshd[80466]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.203.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.203.212
country_id: 1643084
description:
Jul 13 17:37:58 servidor sshd[80466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.203.212


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.90.149.164
country_id: 6252001
description:
Jul 13 17:38:33 servidor sshd[80845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.90.149.164


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:38:45 servidor sshd[80871]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.92.199.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:38:45 servidor sshd[80871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.92.199.36


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.90.149.164
country_id: 6252001
description:
Jul 13 17:38:33 servidor sshd[80845]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.90.149.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 17:39:19 servidor sshd[81154]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 17:39:19 servidor sshd[81154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.212
country_id: 1814991
description:
Jul 13 17:39:46 servidor sshd[81262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.212


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:40:48 servidor sshd[81573]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.181.142.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:40:48 servidor sshd[81573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.142.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:42:40 servidor sshd[82234]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.92.199.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:42:40 servidor sshd[82234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.92.199.36


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:43:55 servidor sshd[82470]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.92.199.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:43:55 servidor sshd[82470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.92.199.36


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:43:56 servidor sshd[82469]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.137.34.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.249.150.91
country_id: 2921044
description:
Jul 13 17:43:26 servidor sshd[82361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.249.150.91  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:43:56 servidor sshd[82469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.137.34.110


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:43:57 servidor sshd[82470]: Failed password for invalid user upload from 91.92.199.36 port 33208 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 17:44:05 -0300] info [cpaneld] 185.243.96.5 - Justin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Justin (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:44:34 servidor sshd[82811]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.181.142.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:44:34 servidor sshd[82811]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.142.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.212
country_id: 1814991
description:
Jul 13 17:44:58 servidor sshd[82857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.212


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:45:54 servidor sshd[84262]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.181.142.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:45:54 servidor sshd[84262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.142.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:45:57 servidor sshd[84267]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.207.200.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:45:57 servidor sshd[84267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.207.200.77


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.103.115.212
country_id: 1814991
description:
Jul 13 17:45:03 servidor sshd[82857]: Disconnected from invalid user streaming 14.103.115.212 port 42934 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.212
country_id: 1814991
description:
Jul 13 17:46:07 servidor sshd[84352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.212


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.124.154.83
country_id: 1880251
description:
Jul 13 17:46:31 servidor sshd[84426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.124.154.83


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.182.74.203
country_id: 798544
description:
Jul 13 17:47:00 servidor sshd[84533]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.182.74.203 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.74.203
country_id: 798544
description:
Jul 13 17:47:00 servidor sshd[84533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.74.203  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:48:32 servidor sshd[85137]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.207.200.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:48:32 servidor sshd[85137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.207.200.77


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 17:49:01 servidor sshd[85233]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 17:49:01 servidor sshd[85233]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.246.224.218  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 17:49:03 servidor sshd[85233]: Failed password for redestreamhost from 106.246.224.218 port 47736 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 17:50:26 servidor sshd[85790]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 17:50:26 servidor sshd[85790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:50:47 servidor sshd[85876]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.207.200.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:50:47 servidor sshd[85876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.207.200.77


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:50:49 servidor sshd[85876]: Failed password for invalid user user from 35.207.200.77 port 34808 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.236.46
country_id: 1643084
description:
[2025-07-13 17:53:49 -0300] info [whostmgrd] 103.65.236.46 - distakec "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 17:54:14 servidor sshd[86748]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 17:54:14 servidor sshd[86748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 17:54:43 servidor sshd[86866]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:55:01 servidor sshd[86881]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.137.34.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:55:01 servidor sshd[86881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.137.34.110


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 17:54:13 servidor sshd[86748]: Invalid user radioitaboraisantos from 193.32.162.218 port 38860


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 17:54:45 servidor sshd[86866]: Failed password for redecast from 92.118.39.34 port 59542 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 17:54:43 servidor sshd[86866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34  user=redecast


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:55:05 servidor sshd[86881]: Disconnected from invalid user astra 113.137.34.110 port 43646 [preauth]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:55:24 servidor sshd[87100]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.137.34.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:55:24 servidor sshd[87100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.137.34.110


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 17:59:56 servidor sshd[88005]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 17:59:56 servidor sshd[88005]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 18:03:56 servidor sshd[90245]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:03:52 servidor sshd[90239]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.83.162.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:03:52 servidor sshd[90239]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.83.162.167  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:04:15 servidor sshd[90341]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.98.255.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.199.112.65
country_id: 2921044
description:
Jul 13 18:04:25 servidor sshd[90363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.199.112.65  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 58.242.187.144
country_id: 1814991
description:
Jul 13 18:04:38 servidor sshd[90399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.242.187.144  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.1.255.55
country_id: 1835841
description:
Jul 13 18:04:43 servidor sshd[90404]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.1.255.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:04:15 servidor sshd[90341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.98.255.233  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-07-13 18:04:22 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:41039: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.199.112.65
country_id: 2921044
description:
Jul 13 18:04:25 servidor sshd[90363]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.199.112.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-07-13 18:04:36 dovecot_login authenticator failed for (superviezzer.static.gvt.net.br) [177.159.99.95]:57519: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.1.255.55
country_id: 1835841
description:
Jul 13 18:04:43 servidor sshd[90404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.1.255.55


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.133.35.58
country_id: 1814991
description:
2025-07-13 18:05:09 dovecot_login authenticator failed for ([117.133.35.58]) [117.133.35.58]:48176: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.144.50
country_id: 3175395
description:
2025-07-13 18:05:27 dovecot_login authenticator failed for ([101.58.144.50]) [101.58.144.50]:35483: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:06:34 servidor sshd[91039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.81.123  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.9.170.231
country_id: 1814991
description:
Jul 13 18:06:47 servidor sshd[91069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.9.170.231  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.252.88.239
country_id: 2921044
description:
Jul 13 18:06:19 servidor sshd[91022]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.252.88.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.252.88.239
country_id: 2921044
description:
Jul 13 18:06:19 servidor sshd[91022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.252.88.239  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:06:34 servidor sshd[91039]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.81.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:07:32 servidor sshd[91243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.83.162.167  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:07:24 servidor sshd[91237]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.98.255.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:07:24 servidor sshd[91237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.98.255.233  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:07:32 servidor sshd[91243]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.83.162.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 58.242.187.144
country_id: 1814991
description:
Jul 13 18:07:49 servidor sshd[91290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.242.187.144  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:07:50 servidor sshd[91296]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.81.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:07:50 servidor sshd[91296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.81.123  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 18:08:03 servidor sshd[91435]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.9.170.231
country_id: 1814991
description:
Jul 13 18:08:39 servidor sshd[91525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.9.170.231  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:08:56 servidor sshd[91623]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.81.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:08:56 servidor sshd[91623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.81.123  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:08:37 servidor sshd[91521]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.98.255.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:08:37 servidor sshd[91521]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.98.255.233  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:09:02 servidor sshd[91667]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.83.162.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:09:02 servidor sshd[91667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.83.162.167  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 58.242.187.144
country_id: 1814991
description:
Jul 13 18:09:16 servidor sshd[91786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.242.187.144  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.211.25.121
country_id: 3175395
description:
Jul 13 18:09:48 servidor sshd[91877]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.211.25.121 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.211.25.121
country_id: 3175395
description:
Jul 13 18:09:48 servidor sshd[91877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.25.121  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 201.69.132.236
country_id: 3469034
description:
Jul 13 18:12:02 servidor sshd[92719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.69.132.236


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.9.170.231
country_id: 1814991
description:
Jul 13 18:11:44 servidor sshd[92596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.9.170.231  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.69.132.236
country_id: 3469034
description:
Jul 13 18:12:02 servidor sshd[92719]: pam_imunify(sshd:auth): [IM360_RBL] The IP 201.69.132.236 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.69.132.236
country_id: 3469034
description:
Jul 13 18:12:04 servidor sshd[92719]: Failed password for invalid user 80907806791 from 201.69.132.236 port 33310 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 18:13:02 -0300] info [cpaneld] 185.243.96.5 - Brandon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Brandon (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.11.165.119
country_id: 3017382
description:
Jul 13 18:13:32 servidor sshd[93020]: pam_imunify(sshd:auth): [IM360_RBL] The IP 141.11.165.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 141.11.165.119
country_id: 3017382
description:
Jul 13 18:13:32 servidor sshd[93020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.11.165.119  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 18:13:40 servidor sshd[93054]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 18:13:40 servidor sshd[93054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 18:15:01 servidor sshd[93313]: pam_imunify(sshd:auth): [IM360_RBL] The IP 1.226.84.145 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 18:15:01 servidor sshd[93313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.226.84.145  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.34.212.116
country_id: 798544
description:
Jul 13 18:19:45 servidor sshd[95650]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.34.212.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.34.212.116
country_id: 798544
description:
Jul 13 18:19:45 servidor sshd[95650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.34.212.116


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 18:21:41 servidor sshd[96319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 18:21:41 servidor sshd[96319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 18:23:49 servidor sshd[97025]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 18:23:49 servidor sshd[97025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.91.86
country_id: 3017382
description:
Jul 13 18:26:33 servidor sshd[97889]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.91.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.91.86
country_id: 3017382
description:
Jul 13 18:26:33 servidor sshd[97889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.91.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.41.244.112
country_id: 1814991
description:
2025-07-13 18:26:17 dovecot_login authenticator failed for ([117.41.244.112]) [117.41.244.112]:47388: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-07-13 18:26:30 dovecot_login authenticator failed for net-93-145-118-40.cust.vodafonedsl.it [93.145.118.40]:55112: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 18:27:42 servidor sshd[98133]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 18:27:42 servidor sshd[98133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 18:30:15 servidor sshd[98855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 18:30:15 servidor sshd[98855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 18:32:39 servidor sshd[100699]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 18:32:39 servidor sshd[100699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.115  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 18:32:42 servidor sshd[100699]: Failed password for redestreamhost from 92.118.39.115 port 36230 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Jul 13 18:35:28 servidor sshd[101485]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.123.231
country_id: 1835841
description:
Jul 13 18:35:28 servidor sshd[101485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.123.231  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 175.126.123.231
country_id: 1835841
description:
Jul 13 18:35:31 servidor sshd[101485]: Failed password for root from 175.126.123.231 port 38606 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.52.21.96
country_id: 6251999
description:
Jul 13 18:38:25 servidor sshd[102272]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.52.21.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.52.21.96
country_id: 6251999
description:
Jul 13 18:38:25 servidor sshd[102272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.52.21.96  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 18:40:51 servidor sshd[102963]: Invalid user radioitaboraisantos from 92.118.39.81 port 40110


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 18:40:51 servidor sshd[102963]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 18:40:51 servidor sshd[102963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.81


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.113.170
country_id: 1269750
description:
2025-07-13 18:41:07 dovecot_login authenticator failed for ([125.21.95.57]) [182.95.113.170]:48806: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.229.128.251
country_id: 2017370
description:
2025-07-13 18:41:19 dovecot_login authenticator failed for ([46.229.128.251]) [46.229.128.251]:46708: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
country_id: 1835841
description:
Jul 13 18:42:09 servidor sshd[103470]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
country_id: 1835841
description:
Jul 13 18:42:09 servidor sshd[103470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 18:42:18 -0300] info [cpaneld] 185.243.96.5 - Jonathan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Jonathan (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 18:44:47 servidor sshd[104154]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.177.116
country_id: 6252001
description:
Jul 13 18:44:54 servidor sshd[104161]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.177.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.177.116
country_id: 6252001
description:
Jul 13 18:44:54 servidor sshd[104161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.177.116


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.190.104
country_id: 6252001
description:
Jul 13 18:45:43 servidor sshd[105640]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.169.190.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.169.190.104
country_id: 6252001
description:
Jul 13 18:45:43 servidor sshd[105640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.190.104


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.228.250.10
country_id: 3895114
description:
Jul 13 18:46:33 servidor sshd[105840]: pam_imunify(sshd:auth): [IM360_RBL] The IP 168.228.250.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 168.228.250.10
country_id: 3895114
description:
Jul 13 18:46:33 servidor sshd[105840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.228.250.10


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.128.112.74
country_id: 732800
description:
Jul 13 18:48:25 servidor sshd[106340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.128.112.74


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 18:51:53 servidor sshd[107192]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.79.180.221
country_id: 2635167
description:
Jul 13 18:52:59 servidor sshd[107398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.79.180.221


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.83.190
country_id: 1861060
description:
Jul 13 18:52:21 servidor sshd[107286]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.95.83.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.95.83.190
country_id: 1861060
description:
Jul 13 18:52:21 servidor sshd[107286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.83.190  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.79.180.221
country_id: 2635167
description:
Jul 13 18:52:59 servidor sshd[107398]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.79.180.221 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 18:55:14 servidor sshd[108117]: Invalid user radioitaboraisantos from 92.118.39.34 port 60760


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 18:55:15 servidor sshd[108117]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 18:55:15 servidor sshd[108117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.164.199.128
country_id: 6252001
description:
Jul 13 18:55:18 servidor sshd[108127]: pam_imunify(sshd:auth): [IM360_RBL] The IP 76.164.199.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 76.164.199.128
country_id: 6252001
description:
Jul 13 18:55:18 servidor sshd[108127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.164.199.128  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-07-13 18:57:12 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:39738: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.138.151.122
country_id: 1814991
description:
2025-07-13 18:57:32 dovecot_login authenticator failed for ([182.138.151.122]) [182.138.151.122]:40126: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
country_id: 1814991
description:
2025-07-13 18:57:59 dovecot_login authenticator failed for ([218.22.237.108]) [218.22.237.108]:47406: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.188.226
country_id: 6251999
description:
2025-07-13 18:58:10 dovecot_login authenticator failed for 198-91-188-226.cpe.distributel.net [198.91.188.226]:33480: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 19:01:30 servidor sshd[110755]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 19:01:30 servidor sshd[110755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.100
country_id: 6252001
description:
Jul 13 19:02:35 servidor sshd[110976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.100  user=mumbacafm


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.100
country_id: 6252001
description:
Jul 13 19:02:37 servidor sshd[110976]: Failed password for mumbacafm from 92.118.39.100 port 38794 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.252.90.190
country_id: 3017382
description:
Jul 13 19:04:30 servidor sshd[111568]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.252.90.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.252.90.190
country_id: 3017382
description:
Jul 13 19:04:30 servidor sshd[111568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.252.90.190  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.61.238
country_id: 1814991
description:
2025-07-13 19:04:37 dovecot_login authenticator failed for ([111.26.61.237]) [111.26.61.238]:59598: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2025-07-13 19:04:55 dovecot_login authenticator failed for ([211.116.107.222]) [211.116.107.222]:44333: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.224
country_id: 732800
description:
Jul 13 19:04:06 servidor sshd[111527]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.110.224 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.224
country_id: 732800
description:
Jul 13 19:04:06 servidor sshd[111527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.224


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.118.39.100
country_id: 6252001
description:
Jul 13 19:06:53 servidor sshd[112147]: Invalid user radiomusicclassicsfm from 92.118.39.100 port 60068


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.100
country_id: 6252001
description:
Jul 13 19:06:53 servidor sshd[112147]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.100
country_id: 6252001
description:
Jul 13 19:06:53 servidor sshd[112147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.100


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.247.24.89
country_id: 1835841
description:
Jul 13 19:08:02 servidor sshd[112391]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.247.24.89 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.247.24.89
country_id: 1835841
description:
Jul 13 19:08:02 servidor sshd[112391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.24.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.120.127
country_id: 1269750
description:
2025-07-13 19:07:09 dovecot_login authenticator failed for ([182.70.120.127]) [182.70.120.127]:53062: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
country_id: 1835841
description:
2025-07-13 19:07:33 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:48515: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.247.24.89
country_id: 1835841
description:
Jul 13 19:08:04 servidor sshd[112391]: Failed password for invalid user adcolheita from 49.247.24.89 port 33956 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 19:08:30 servidor sshd[112490]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 19:08:30 servidor sshd[112490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 19:09:17 servidor sshd[112809]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 19:09:17 servidor sshd[112809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.224
country_id: 732800
description:
Jul 13 19:10:32 servidor sshd[113133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.224


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.224
country_id: 732800
description:
Jul 13 19:10:32 servidor sshd[113133]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.110.224 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 19:11:31 -0300] info [cpaneld] 185.243.96.5 - Kevin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Kevin (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 19:13:10 servidor sshd[114218]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.126
country_id: 1269750
description:
2025-07-13 19:13:10 dovecot_login authenticator failed for ([152.52.219.185]) [182.95.47.126]:48550: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
country_id: 1835841
description:
2025-07-13 19:13:26 dovecot_login authenticator failed for ([1.244.246.221]) [1.244.246.221]:49196: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.214.6.212
country_id: 2750405
description:
Jul 13 19:14:14 servidor sshd[114592]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.214.6.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.214.6.212
country_id: 2750405
description:
Jul 13 19:14:14 servidor sshd[114592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.214.6.212


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.55.179
country_id: 2921044
description:
Jul 13 19:16:05 servidor sshd[116244]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.55.179 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.55.179
country_id: 2921044
description:
Jul 13 19:16:05 servidor sshd[116244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.55.179


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.224
country_id: 732800
description:
Jul 13 19:16:53 servidor sshd[116372]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.110.224 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.224
country_id: 732800
description:
Jul 13 19:16:53 servidor sshd[116372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.224


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 19:21:25 servidor sshd[117803]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 19:21:25 servidor sshd[117803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.58.67
country_id: 2635167
description:
Jul 13 19:21:56 servidor sshd[118095]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.58.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.58.67
country_id: 2635167
description:
Jul 13 19:21:56 servidor sshd[118095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.58.67


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.149.146.202
country_id: 2921044
description:
Jul 13 19:23:09 servidor sshd[118391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.149.146.202  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 185.149.146.202
country_id: 2921044
description:
Jul 13 19:23:11 servidor sshd[118391]: Failed password for root from 185.149.146.202 port 60144 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.100
country_id: 6252001
description:
Jul 13 19:23:57 servidor sshd[118522]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.100
country_id: 6252001
description:
Jul 13 19:23:57 servidor sshd[118522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.100


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.149.146.202
country_id: 2921044
description:
Jul 13 19:23:09 servidor sshd[118391]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.149.146.202 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 19:24:30 servidor sshd[118739]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.58.67
country_id: 2635167
description:
Jul 13 19:24:39 servidor sshd[118905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.58.67


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.134.22.66
country_id: 1880251
description:
Jul 13 19:24:12 servidor sshd[118647]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.134.22.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.134.22.66
country_id: 1880251
description:
Jul 13 19:24:12 servidor sshd[118647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.134.22.66  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.58.67
country_id: 2635167
description:
Jul 13 19:24:39 servidor sshd[118905]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.58.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.58.67
country_id: 2635167
description:
Jul 13 19:25:53 servidor sshd[119268]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.58.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.58.67
country_id: 2635167
description:
Jul 13 19:25:53 servidor sshd[119268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.58.67


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.114.37.178
country_id: 2921044
description:
Jul 13 19:25:56 servidor sshd[119293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.114.37.178


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.58.67
country_id: 2635167
description:
Jul 13 19:25:56 servidor sshd[119268]: Failed password for invalid user nginx from 46.101.58.67 port 55765 ssh2


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 19:27:25 servidor sshd[119730]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.142.143.51
country_id: 298795
description:
Jul 13 19:29:36 servidor sshd[120190]: pam_imunify(sshd:auth): [IM360_RBL] The IP 213.142.143.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 213.142.143.51
country_id: 298795
description:
Jul 13 19:29:36 servidor sshd[120190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.142.143.51


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.201.4.38
country_id: 458258
description:
Jul 13 19:31:48 servidor sshd[122167]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.201.4.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 89.201.4.38
country_id: 458258
description:
Jul 13 19:31:48 servidor sshd[122167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.201.4.38  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.236.164
country_id: 1562822
description:
Jul 13 19:35:03 servidor sshd[123061]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.172.236.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.172.236.164
country_id: 1562822
description:
Jul 13 19:35:03 servidor sshd[123061]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.172.236.164  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
country_id: 1269750
description:
Jul 13 19:34:53 servidor sshd[122849]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
country_id: 1269750
description:
Jul 13 19:34:53 servidor sshd[122849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 103.172.236.164
country_id: 1562822
description:
Jul 13 19:35:05 servidor sshd[123061]: Failed password for root from 103.172.236.164 port 57270 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 19:35:08 servidor sshd[123194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 19:35:08 servidor sshd[123194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 19:37:49 servidor sshd[123770]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 19:37:49 servidor sshd[123770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.37


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 19:40:48 -0300] info [cpaneld] 185.243.96.5 - Thomas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Thomas (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 19:40:09 servidor sshd[124468]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 19:40:09 servidor sshd[124468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.37  user=redecast


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 19:40:12 servidor sshd[124468]: Failed password for redecast from 92.118.39.37 port 55536 ssh2


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 19:42:36 servidor sshd[125128]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 19:43:11 servidor sshd[125231]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 19:43:11 servidor sshd[125231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.189.208.13
country_id: 1562822
description:
Jul 13 19:47:49 servidor sshd[127770]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.189.208.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.189.208.13
country_id: 1562822
description:
Jul 13 19:47:49 servidor sshd[127770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.189.208.13  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.4.70.205
country_id: 690791
description:
Jul 13 19:48:17 servidor sshd[127870]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.4.70.205 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.4.70.205
country_id: 690791
description:
Jul 13 19:48:17 servidor sshd[127870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.4.70.205


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.22.160.113
country_id: 3996063
description:
Jul 13 19:49:28 servidor sshd[128124]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.22.160.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.22.160.113
country_id: 3996063
description:
Jul 13 19:49:28 servidor sshd[128124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.22.160.113  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.31.95.163
country_id: 3686110
description:
Jul 13 19:49:45 servidor sshd[128211]: pam_imunify(sshd:auth): [IM360_RBL] The IP 186.31.95.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 186.31.95.163
country_id: 3686110
description:
Jul 13 19:49:45 servidor sshd[128211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.31.95.163  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.15.170.124
country_id: 3017382
description:
Jul 13 19:50:49 servidor sshd[128550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.170.124  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.103.169.12
country_id: 3895114
description:
Jul 13 19:50:13 servidor sshd[128435]: pam_imunify(sshd:auth): [IM360_RBL] The IP 186.103.169.12 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 186.103.169.12
country_id: 3895114
description:
Jul 13 19:50:13 servidor sshd[128435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.103.169.12  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.34.252
country_id: 1814991
description:
Jul 13 19:51:09 servidor sshd[128634]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.34.252 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.34.252
country_id: 1814991
description:
Jul 13 19:51:09 servidor sshd[128634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.34.252  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.162.5.37
country_id: 1269750
description:
Jul 13 19:51:32 servidor sshd[128664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.162.5.37  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.189.208.13
country_id: 1562822
description:
Jul 13 19:51:51 servidor sshd[128782]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.189.208.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.189.208.13
country_id: 1562822
description:
Jul 13 19:51:51 servidor sshd[128782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.189.208.13  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 186.103.169.12
country_id: 3895114
description:
Jul 13 19:52:49 servidor sshd[129117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.103.169.12  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 186.31.95.163
country_id: 3686110
description:
Jul 13 19:52:30 servidor sshd[129028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.31.95.163  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.103.169.12
country_id: 3895114
description:
Jul 13 19:52:49 servidor sshd[129117]: pam_imunify(sshd:auth): [IM360_RBL] The IP 186.103.169.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.31.95.163
country_id: 3686110
description:
Jul 13 19:52:30 servidor sshd[129028]: pam_imunify(sshd:auth): [IM360_RBL] The IP 186.31.95.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.15.170.124
country_id: 3017382
description:
Jul 13 19:52:38 servidor sshd[129053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.170.124  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.22.160.113
country_id: 3996063
description:
Jul 13 19:52:13 servidor sshd[129003]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.22.160.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.22.160.113
country_id: 3996063
description:
Jul 13 19:52:13 servidor sshd[129003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.22.160.113  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.189.208.13
country_id: 1562822
description:
Jul 13 19:53:19 servidor sshd[129254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.189.208.13  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.22.160.113
country_id: 3996063
description:
Jul 13 19:53:29 servidor sshd[129306]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.22.160.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.22.160.113
country_id: 3996063
description:
Jul 13 19:53:29 servidor sshd[129306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.22.160.113  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.15.170.124
country_id: 3017382
description:
Jul 13 19:53:45 servidor sshd[129448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.170.124  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.162.5.37
country_id: 1269750
description:
Jul 13 19:53:14 servidor sshd[129250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.162.5.37  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.189.208.13
country_id: 1562822
description:
Jul 13 19:53:19 servidor sshd[129254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.189.208.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.31.95.163
country_id: 3686110
description:
Jul 13 19:54:08 servidor sshd[129550]: pam_imunify(sshd:auth): [IM360_RBL] The IP 186.31.95.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 186.31.95.163
country_id: 3686110
description:
Jul 13 19:54:08 servidor sshd[129550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.31.95.163  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.103.169.12
country_id: 3895114
description:
Jul 13 19:54:16 servidor sshd[129598]: pam_imunify(sshd:auth): [IM360_RBL] The IP 186.103.169.12 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 186.103.169.12
country_id: 3895114
description:
Jul 13 19:54:16 servidor sshd[129598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.103.169.12  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.162.5.37
country_id: 1269750
description:
Jul 13 19:54:43 servidor sshd[129714]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.162.5.37  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 19:55:25 servidor sshd[130049]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 19:55:25 servidor sshd[130049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.119.7.6
country_id: 1835841
description:
Jul 13 19:57:02 servidor sshd[130408]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.119.7.6  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 19:57:57 servidor sshd[130738]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.43.19.14
country_id: 1814991
description:
Jul 13 19:57:42 servidor sshd[130654]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.43.19.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.43.19.14
country_id: 1814991
description:
Jul 13 19:57:42 servidor sshd[130654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.43.19.14  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.75.92.136
country_id: 1814991
description:
2025-07-13 19:58:09 dovecot_login authenticator failed for ([159.75.92.136]) [159.75.92.136]:41460: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.159.230
country_id: 1835841
description:
2025-07-13 19:58:50 dovecot_login authenticator failed for ([220.72.159.230]) [220.72.159.230]:47470: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.115.125
country_id: 6252001
description:
Jul 13 19:59:47 servidor sshd[131109]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.115.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
country_id: 6252001
description:
Jul 13 19:59:47 servidor sshd[131109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.30.45.112
country_id: 1562822
description:
Jul 13 20:01:21 servidor sshd[132875]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.30.45.112 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.43.19.14
country_id: 1814991
description:
Jul 13 20:01:32 servidor sshd[132890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.43.19.14  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.206.75
country_id: 6252001
description:
Jul 13 20:01:17 servidor sshd[132870]: pam_imunify(sshd:auth): [IM360_RBL] The IP 147.182.206.75 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 147.182.206.75
country_id: 6252001
description:
Jul 13 20:01:17 servidor sshd[132870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.182.206.75


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2025-07-13 20:01:55 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:52226: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.30.45.112
country_id: 1562822
description:
Jul 13 20:01:21 servidor sshd[132875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.30.45.112


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.43.19.14
country_id: 1814991
description:
Jul 13 20:01:32 servidor sshd[132890]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.43.19.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-07-13 20:01:42 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:54102: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
country_id: 1835841
description:
Jul 13 20:02:23 servidor sshd[133112]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
country_id: 1835841
description:
Jul 13 20:02:23 servidor sshd[133112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 13 20:03:06 servidor sshd[133424]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 13 20:03:06 servidor sshd[133424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.83  user=redestreamhost


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.43.19.14
country_id: 1814991
description:
Jul 13 20:03:06 servidor sshd[133255]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.43.19.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.43.19.14
country_id: 1814991
description:
Jul 13 20:03:06 servidor sshd[133255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.43.19.14  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 13 20:03:08 servidor sshd[133424]: Failed password for redestreamhost from 92.118.39.83 port 44284 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
country_id: 1643084
description:
Jul 13 20:04:37 servidor sshd[133812]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
country_id: 1643084
description:
Jul 13 20:04:37 servidor sshd[133812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.119.7.6
country_id: 1835841
description:
Jul 13 20:05:58 servidor sshd[134300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.119.7.6  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 20:06:59 servidor sshd[134499]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 20:06:59 servidor sshd[134499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.199.36.198
country_id: 2921044
description:
Jul 13 20:06:19 servidor sshd[134379]: pam_imunify(sshd:auth): [IM360_RBL] The IP 213.199.36.198 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 213.199.36.198
country_id: 2921044
description:
Jul 13 20:06:19 servidor sshd[134379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.199.36.198


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.34.252
country_id: 1814991
description:
Jul 13 20:06:26 servidor sshd[134382]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.34.252 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.34.252
country_id: 1814991
description:
Jul 13 20:06:26 servidor sshd[134382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.34.252  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.34.252
country_id: 1814991
description:
Jul 13 20:07:06 servidor sshd[134542]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.34.252 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.34.252
country_id: 1814991
description:
Jul 13 20:07:06 servidor sshd[134542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.34.252  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 20:07:25 servidor sshd[134659]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 20:07:25 servidor sshd[134659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.81


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 20:08:43 servidor sshd[135031]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 20:08:43 servidor sshd[135031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.247.178.81
country_id: 1269750
description:
Jul 13 20:09:30 servidor sshd[135208]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.247.178.81  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.171.150
country_id: 1814991
description:
2025-07-13 20:09:52 dovecot_login authenticator failed for ([221.0.171.150]) [221.0.171.150]:55767: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 20:10:04 -0300] info [cpaneld] 185.243.96.5 - Eric "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Eric (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2025-07-13 20:10:07 dovecot_login authenticator failed for ([220.122.115.9]) [220.122.115.9]:43250: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.119.7.6
country_id: 1835841
description:
Jul 13 20:10:12 servidor sshd[135621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.119.7.6  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.247.178.81
country_id: 1269750
description:
Jul 13 20:11:33 servidor sshd[135910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.247.178.81  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 20:12:22 servidor sshd[136093]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 20:12:47 servidor sshd[136137]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 20:12:47 servidor sshd[136137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.247.178.81
country_id: 1269750
description:
Jul 13 20:12:59 servidor sshd[136158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.247.178.81  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 20:13:39 servidor sshd[136535]: pam_imunify(sshd:auth): [IM360_RBL] The IP 1.226.84.145 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 20:13:39 servidor sshd[136535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.226.84.145  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.231.110.214
country_id: 6252001
description:
Jul 13 20:14:06 servidor sshd[136711]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.231.110.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.231.110.214
country_id: 6252001
description:
Jul 13 20:14:06 servidor sshd[136711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.231.110.214


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 20:15:28 servidor sshd[138357]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 20:15:28 servidor sshd[138357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 201.158.20.37
country_id: 3469034
description:
Jul 13 20:16:55 servidor sshd[138640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.158.20.37  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.176.84.4
country_id: 6252001
description:
Jul 13 20:17:22 servidor sshd[138812]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.176.84.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.176.84.4
country_id: 6252001
description:
Jul 13 20:17:22 servidor sshd[138812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.176.84.4  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.98.0
country_id: 1880251
description:
Jul 13 20:18:22 servidor sshd[139026]: pam_imunify(sshd:auth): [IM360_RBL] The IP 134.209.98.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 134.209.98.0
country_id: 1880251
description:
Jul 13 20:18:22 servidor sshd[139026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.98.0  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.34.38
country_id: 1269750
description:
2025-07-13 20:21:32 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.34.38]:44242: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2025-07-13 20:21:17 dovecot_login authenticator failed for (host-94.124.225.159.gascom.net.ru) [94.124.225.159]:60666: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.136.114.196
country_id: 2510769
description:
Jul 13 20:24:33 servidor sshd[140754]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.136.114.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.136.114.196
country_id: 2510769
description:
Jul 13 20:24:33 servidor sshd[140754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.136.114.196  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 89.213.140.50
country_id: 3017382
description:
Jul 13 20:25:42 servidor sshd[141463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.213.140.50


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 20:25:52 servidor sshd[141474]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.130.113.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.217.10.49
country_id: 1522867
description:
Jul 13 20:25:13 servidor sshd[141205]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.217.10.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.217.10.49
country_id: 1522867
description:
Jul 13 20:25:13 servidor sshd[141205]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.217.10.49  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 20:25:52 servidor sshd[141474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.130.113.204  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 20:25:53 servidor sshd[141474]: Failed password for root from 125.130.113.204 port 56078 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.55.187.215
country_id: 1835841
description:
Jul 13 20:26:38 servidor sshd[141656]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.55.187.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.55.187.215
country_id: 1835841
description:
Jul 13 20:26:38 servidor sshd[141656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.55.187.215  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 20:26:42 servidor sshd[141668]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 20:26:42 servidor sshd[141668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-07-13 20:27:42 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:50367: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.12.175.66
country_id: 1814991
description:
2025-07-13 20:27:57 dovecot_login authenticator failed for ([221.12.175.66]) [221.12.175.66]:59942: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 20:28:50 servidor sshd[142147]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.136.114.196
country_id: 2510769
description:
Jul 13 20:28:35 servidor sshd[142106]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.136.114.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.136.114.196
country_id: 2510769
description:
Jul 13 20:28:35 servidor sshd[142106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.136.114.196  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.217.10.49
country_id: 1522867
description:
Jul 13 20:29:01 servidor sshd[142150]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.217.10.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.217.10.49
country_id: 1522867
description:
Jul 13 20:29:01 servidor sshd[142150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.217.10.49  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.55.187.215
country_id: 1835841
description:
Jul 13 20:29:35 servidor sshd[142497]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.55.187.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.55.187.215
country_id: 1835841
description:
Jul 13 20:29:35 servidor sshd[142497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.55.187.215  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.136.114.196
country_id: 2510769
description:
Jul 13 20:29:49 servidor sshd[142612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.136.114.196  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.136.114.196
country_id: 2510769
description:
Jul 13 20:29:49 servidor sshd[142612]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.136.114.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.122.238
country_id: 2921044
description:
Jul 13 20:30:12 servidor sshd[142931]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.122.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.122.238
country_id: 2921044
description:
Jul 13 20:30:12 servidor sshd[142931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.122.238  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.217.10.49
country_id: 1522867
description:
Jul 13 20:30:25 servidor sshd[143018]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.217.10.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.48.221
country_id: 1880251
description:
Jul 13 20:30:45 servidor sshd[144449]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.48.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.48.221
country_id: 1880251
description:
Jul 13 20:30:45 servidor sshd[144449]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.48.221  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.55.187.215
country_id: 1835841
description:
Jul 13 20:31:01 servidor sshd[144482]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.55.187.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.217.10.49
country_id: 1522867
description:
Jul 13 20:30:25 servidor sshd[143018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.217.10.49  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.55.187.215
country_id: 1835841
description:
Jul 13 20:31:01 servidor sshd[144482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.55.187.215  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 20:32:01 servidor sshd[144766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 20:32:01 servidor sshd[144766]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 20:39:15 -0300] info [cpaneld] 185.243.96.5 - Tyler "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Tyler (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.77.222.24
country_id: 3017382
description:
Jul 13 20:41:53 servidor sshd[147982]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.222.24


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 20:42:41 servidor sshd[148164]: Invalid user radioitaboraisantos from 193.32.162.218 port 35194


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 20:42:41 servidor sshd[148164]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 20:42:41 servidor sshd[148164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 20:45:01 servidor sshd[148671]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-07-13 20:44:57 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:51748: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 20:45:32 servidor sshd[150323]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2025-07-13 20:45:23 dovecot_login authenticator failed for ([220.122.115.9]) [220.122.115.9]:35551: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.244.77.50
country_id: 2960313
description:
Jul 13 20:47:54 servidor sshd[150864]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.244.77.50 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.244.77.50
country_id: 2960313
description:
Jul 13 20:47:54 servidor sshd[150864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.77.50  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.114.45.37
country_id: 2921044
description:
Jul 13 20:48:34 servidor sshd[151279]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.114.45.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.114.45.37
country_id: 2921044
description:
Jul 13 20:48:34 servidor sshd[151279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.114.45.37  user=ftp


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 20:51:00 servidor sshd[151949]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.83.136
country_id: 241170
description:
Jul 13 20:51:25 servidor sshd[152151]: pam_imunify(sshd:auth): [IM360_RBL] The IP 196.251.83.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 196.251.83.136
country_id: 241170
description:
Jul 13 20:51:25 servidor sshd[152151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.251.83.136


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.145.72.84
country_id: 3017382
description:
Jul 13 20:53:32 servidor sshd[152687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.145.72.84


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.128.112.74
country_id: 732800
description:
Jul 13 20:53:50 servidor sshd[152794]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.128.112.74


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.145.72.84
country_id: 3017382
description:
Jul 13 20:53:32 servidor sshd[152687]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.145.72.84 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 20:55:35 servidor sshd[153241]: Invalid user radiomusicclassicsfm from 92.118.39.115 port 33600


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 20:55:35 servidor sshd[153241]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 20:55:35 servidor sshd[153241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.115


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.65.148.61
country_id: 2750405
description:
Jul 13 20:57:03 servidor sshd[153682]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.65.148.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.65.148.61
country_id: 2750405
description:
Jul 13 20:57:03 servidor sshd[153681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.65.148.61  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.105.195
country_id: 1814991
description:
2025-07-13 20:57:09 dovecot_login authenticator failed for ([223.166.105.195]) [223.166.105.195]:42740: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.191.175.4
country_id: 1562822
description:
Jul 13 20:57:27 servidor sshd[153828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.191.175.4  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.65.148.61
country_id: 2750405
description:
Jul 13 20:57:03 servidor sshd[153688]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.65.148.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.65.148.61
country_id: 2750405
description:
Jul 13 20:57:04 servidor sshd[153685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.65.148.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.175.4
country_id: 1562822
description:
Jul 13 20:57:27 servidor sshd[153828]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.191.175.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.63.220.210
country_id: 1814991
description:
2025-07-13 20:57:29 dovecot_login authenticator failed for ([183.63.220.210]) [183.63.220.210]:57916: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.77.153.34
country_id: 3017382
description:
Jul 13 20:58:58 servidor sshd[154141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.153.34


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.153.34
country_id: 3017382
description:
Jul 13 20:58:58 servidor sshd[154141]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.77.153.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 196.189.89.247
country_id: 337996
description:
Jul 13 21:01:42 servidor sshd[156375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.189.89.247  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 21:02:57 servidor sshd[156701]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.195.149.120
country_id: 3017382
description:
Jul 13 21:02:54 servidor sshd[156674]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.195.149.120 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.195.149.120
country_id: 3017382
description:
Jul 13 21:02:54 servidor sshd[156674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.149.120  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.250.152
country_id: 1880251
description:
Jul 13 21:04:50 servidor sshd[157109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.250.152  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 128.199.250.152
country_id: 1880251
description:
Jul 13 21:04:51 servidor sshd[157109]: Failed password for root from 128.199.250.152 port 44102 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 21:04:08 servidor sshd[157012]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.85.114.218
country_id: 1218197
description:
Jul 13 21:04:19 servidor sshd[157024]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.85.114.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.172.117
country_id: 1819730
description:
Jul 13 21:04:32 servidor sshd[157050]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.32.172.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.250.152
country_id: 1880251
description:
Jul 13 21:04:50 servidor sshd[157109]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.250.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 21:04:08 servidor sshd[157012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.85.114.218
country_id: 1218197
description:
Jul 13 21:04:19 servidor sshd[157024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.85.114.218  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.32.172.117
country_id: 1819730
description:
Jul 13 21:04:32 servidor sshd[157050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.172.117  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.85.114.218
country_id: 1218197
description:
Jul 13 21:06:02 servidor sshd[157525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.85.114.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.195.149.120
country_id: 3017382
description:
Jul 13 21:06:03 servidor sshd[157570]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.195.149.120 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.195.149.120
country_id: 3017382
description:
Jul 13 21:06:03 servidor sshd[157570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.149.120  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.85.114.218
country_id: 1218197
description:
Jul 13 21:06:02 servidor sshd[157525]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.85.114.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.32.172.117
country_id: 1819730
description:
Jul 13 21:06:49 servidor sshd[157706]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.172.117  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.250.152
country_id: 1880251
description:
Jul 13 21:07:02 servidor sshd[157924]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.250.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.172.117
country_id: 1819730
description:
Jul 13 21:06:49 servidor sshd[157706]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.32.172.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.85.114.218
country_id: 1218197
description:
Jul 13 21:06:57 servidor sshd[157759]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.85.114.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.85.114.218
country_id: 1218197
description:
Jul 13 21:06:57 servidor sshd[157759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.85.114.218  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.250.152
country_id: 1880251
description:
Jul 13 21:07:02 servidor sshd[157924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.250.152  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 128.199.250.152
country_id: 1880251
description:
Jul 13 21:07:04 servidor sshd[157924]: Failed password for root from 128.199.250.152 port 45684 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.195.149.120
country_id: 3017382
description:
Jul 13 21:07:09 servidor sshd[157991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.195.149.120 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.195.149.120
country_id: 3017382
description:
Jul 13 21:07:09 servidor sshd[157991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.149.120  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.212.103.171
country_id: 798549
description:
Jul 13 21:07:17 servidor sshd[158045]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.212.103.171 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.212.103.171
country_id: 798549
description:
Jul 13 21:07:17 servidor sshd[158045]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.212.103.171


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 21:08:24 -0300] info [cpaneld] 185.243.96.5 - Benjamin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Benjamin (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.250.152
country_id: 1880251
description:
Jul 13 21:08:27 servidor sshd[158299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.250.152  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.32.172.117
country_id: 1819730
description:
Jul 13 21:08:10 servidor sshd[158240]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.32.172.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.173.178
country_id: 1210997
description:
Jul 13 21:08:23 servidor sshd[158289]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.84.173.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.84.173.178
country_id: 1210997
description:
Jul 13 21:08:23 servidor sshd[158289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.84.173.178  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.32.172.117
country_id: 1819730
description:
Jul 13 21:08:10 servidor sshd[158240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.172.117  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.63.175
country_id: 1814991
description:
2025-07-13 21:08:21 dovecot_login authenticator failed for ([182.135.63.175]) [182.135.63.175]:52356: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.250.152
country_id: 1880251
description:
Jul 13 21:08:27 servidor sshd[158299]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.250.152 has been locked due to Imunify RBL


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 128.199.250.152
country_id: 1880251
description:
Jul 13 21:08:29 servidor sshd[158299]: Failed password for root from 128.199.250.152 port 47678 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.130.141.113
country_id: 1835841
description:
2025-07-13 21:08:34 dovecot_login authenticator failed for ([223.130.141.113]) [223.130.141.113]:29742: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 13 21:12:58 servidor sshd[159465]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 13 21:12:58 servidor sshd[159465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.83


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 21:16:38 servidor sshd[161794]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 21:16:38 servidor sshd[161794]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.5.55.253
country_id: 1605651
description:
Jul 13 21:16:48 servidor sshd[161807]: pam_imunify(sshd:auth): [IM360_RBL] The IP 171.5.55.253 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 171.5.55.253
country_id: 1605651
description:
Jul 13 21:16:48 servidor sshd[161807]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.5.55.253


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 21:21:15 servidor sshd[163061]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.169.204.193
country_id: 3469034
description:
Jul 13 21:22:18 servidor sshd[163325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.169.204.193  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2025-07-13 21:22:47 dovecot_login authenticator failed for 249.151.48.116.static.netvigator.com [116.48.151.249]:52839: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2025-07-13 21:23:00 dovecot_login authenticator failed for ([180.168.119.2]) [180.168.119.2]:51647: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.169.204.193
country_id: 3469034
description:
Jul 13 21:22:18 servidor sshd[163325]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.169.204.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
country_id: 2017370
description:
2025-07-13 21:23:34 dovecot_login authenticator failed for (14.12.168.188.retail.ttk.ru) [188.168.12.14]:51302: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.171.42.206
country_id: 1814991
description:
2025-07-13 21:23:47 dovecot_login authenticator failed for ([39.171.42.206]) [39.171.42.206]:38048: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.235.86.152
country_id: 798544
description:
Jul 13 21:26:38 servidor sshd[164721]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.235.86.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.235.86.152
country_id: 798544
description:
Jul 13 21:26:38 servidor sshd[164721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.235.86.152  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.20.18.85
country_id: 617790
description:
Jul 13 21:26:40 servidor sshd[164729]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.20.18.85 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.20.18.85
country_id: 617790
description:
Jul 13 21:26:40 servidor sshd[164729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.20.18.85


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.148.77.164
country_id: 6252001
description:
Jul 13 21:30:18 servidor sshd[165818]: pam_imunify(sshd:auth): [IM360_RBL] The IP 132.148.77.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.164
country_id: 6252001
description:
Jul 13 21:30:18 servidor sshd[165818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.164  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.118.48.136
country_id: 1562822
description:
Jul 13 21:32:00 servidor sshd[167432]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.118.48.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.118.48.136
country_id: 1562822
description:
Jul 13 21:32:00 servidor sshd[167432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.118.48.136  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 21:32:46 servidor sshd[167627]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 21:34:48 servidor sshd[168263]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.131.12.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 21:34:48 servidor sshd[168263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.131.12.238  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.87.128
country_id: 2921044
description:
Jul 13 21:35:53 servidor sshd[168680]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.87.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.87.128
country_id: 2921044
description:
Jul 13 21:35:53 servidor sshd[168680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.87.128  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 21:37:32 -0300] info [cpaneld] 185.243.96.5 - Steven "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Steven (has_cpuser_file failed)


plugin: ossec
rule: 5403
name: First time user executed sudo.
description:
Jul 13 21:39:14 servidor sudo[169641]: wp-toolkit : (command continued) feature-10=sslinstall feature-11=wp-toolkit feature-12=wp-toolkit-deluxe --output=json'


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 8.222.166.242
country_id: 1880251
description:
Jul 13 21:41:48 servidor sshd[170768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.222.166.242  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 21:41:35 servidor sshd[170538]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.131.12.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 21:41:35 servidor sshd[170538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.131.12.238  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.36.40.104
country_id: 2510769
description:
Jul 13 21:42:30 servidor sshd[170969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.36.40.104  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.187.147.165
country_id: 1643084
description:
Jul 13 21:42:45 servidor sshd[171006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.187.147.165  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 103.187.147.165
country_id: 1643084
description:
Jul 13 21:42:47 servidor sshd[171006]: Failed password for root from 103.187.147.165 port 39648 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.97.210.245
country_id: 2921044
description:
Jul 13 21:42:16 servidor sshd[170908]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.97.210.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.97.210.245
country_id: 2921044
description:
Jul 13 21:42:16 servidor sshd[170908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.97.210.245  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.36.40.104
country_id: 2510769
description:
Jul 13 21:42:30 servidor sshd[170969]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.36.40.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.147.165
country_id: 1643084
description:
Jul 13 21:42:45 servidor sshd[171006]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.187.147.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.192.46.49
country_id: 2542007
description:
Jul 13 21:43:15 servidor sshd[171126]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.192.46.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.192.46.49
country_id: 2542007
description:
Jul 13 21:43:15 servidor sshd[171126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.192.46.49  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.179.109.66
country_id: 690791
description:
Jul 13 21:43:19 servidor sshd[171142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.179.109.66  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.70.127.17
country_id: 1269750
description:
Jul 13 21:43:36 servidor sshd[171225]: pam_imunify(sshd:auth): [IM360_RBL] The IP 98.70.127.17 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.67.78.166
country_id: 1643084
description:
Jul 13 21:43:08 servidor sshd[171096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.67.78.166  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 98.70.127.17
country_id: 1269750
description:
Jul 13 21:43:36 servidor sshd[171225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.70.127.17  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.78.166
country_id: 1643084
description:
Jul 13 21:43:08 servidor sshd[171096]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.67.78.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.179.109.66
country_id: 690791
description:
Jul 13 21:43:19 servidor sshd[171142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.179.109.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.212.153
country_id: 6252001
description:
2025-07-13 21:44:20 dovecot_login authenticator failed for 47-158-212-153.lsan.ca.frontiernet.net [47.158.212.153]:53778: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.52.221
country_id: 2661886
description:
2025-07-13 21:44:37 dovecot_login authenticator failed for c188-150-52-221.bredband.tele2.se [188.150.52.221]:44730: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.97.210.245
country_id: 2921044
description:
Jul 13 21:45:56 servidor sshd[173292]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.97.210.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.36.40.104
country_id: 2510769
description:
Jul 13 21:45:52 servidor sshd[173283]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.36.40.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 13 21:45:53 servidor sshd[173285]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.97.210.245
country_id: 2921044
description:
Jul 13 21:45:56 servidor sshd[173292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.97.210.245  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
country_id: 1835841
description:
Jul 13 21:45:39 servidor sshd[173249]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 21:45:43 servidor sshd[173252]: Failed password for redecast from 92.118.39.81 port 37160 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 13 21:45:53 servidor sshd[173285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.83


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
country_id: 1835841
description:
Jul 13 21:45:39 servidor sshd[173249]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 21:45:40 servidor sshd[173252]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 21:45:40 servidor sshd[173252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.81  user=redecast


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.36.40.104
country_id: 2510769
description:
Jul 13 21:45:52 servidor sshd[173283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.36.40.104  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.158.60.90
country_id: 3017382
description:
Jul 13 21:45:26 servidor sshd[173163]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.158.60.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.158.60.90
country_id: 3017382
description:
Jul 13 21:45:26 servidor sshd[173163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.60.90  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.78.166
country_id: 1643084
description:
Jul 13 21:46:41 servidor sshd[173495]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.67.78.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.67.78.166
country_id: 1643084
description:
Jul 13 21:46:41 servidor sshd[173495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.67.78.166  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.192.46.49
country_id: 2542007
description:
Jul 13 21:46:07 servidor sshd[173373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.192.46.49  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.179.109.66
country_id: 690791
description:
Jul 13 21:46:22 servidor sshd[173399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.179.109.66  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.36.40.104
country_id: 2510769
description:
Jul 13 21:47:02 servidor sshd[173570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.36.40.104  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.36.40.104
country_id: 2510769
description:
Jul 13 21:47:02 servidor sshd[173570]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.36.40.104 has been locked due to Imunify RBL


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 116.193.190.165
country_id: 1643084
description:
Jul 13 21:46:39 servidor sshd[173481]: Failed password for root from 116.193.190.165 port 36798 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.179.109.66
country_id: 690791
description:
Jul 13 21:46:22 servidor sshd[173399]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.179.109.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.193.190.165
country_id: 1643084
description:
Jul 13 21:46:37 servidor sshd[173481]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.193.190.165 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.193.190.165
country_id: 1643084
description:
Jul 13 21:46:37 servidor sshd[173481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.193.190.165  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.192.46.49
country_id: 2542007
description:
Jul 13 21:46:07 servidor sshd[173373]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.192.46.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.97.210.245
country_id: 2921044
description:
Jul 13 21:47:06 servidor sshd[173600]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.97.210.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 174.138.59.242
country_id: 6252001
description:
Jul 13 21:47:31 servidor sshd[173748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.59.242  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.97.210.245
country_id: 2921044
description:
Jul 13 21:47:06 servidor sshd[173600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.97.210.245  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.179.109.66
country_id: 690791
description:
Jul 13 21:47:35 servidor sshd[173800]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.179.109.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.179.109.66
country_id: 690791
description:
Jul 13 21:47:35 servidor sshd[173800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.179.109.66  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.147.165
country_id: 1643084
description:
Jul 13 21:47:37 servidor sshd[173850]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.187.147.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.70.127.17
country_id: 1269750
description:
Jul 13 21:47:14 servidor sshd[173682]: pam_imunify(sshd:auth): [IM360_RBL] The IP 98.70.127.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.138.59.242
country_id: 6252001
description:
Jul 13 21:47:31 servidor sshd[173748]: pam_imunify(sshd:auth): [IM360_RBL] The IP 174.138.59.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.187.147.165
country_id: 1643084
description:
Jul 13 21:47:37 servidor sshd[173850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.187.147.165  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 98.70.127.17
country_id: 1269750
description:
Jul 13 21:47:14 servidor sshd[173682]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.70.127.17  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.192.46.49
country_id: 2542007
description:
Jul 13 21:47:20 servidor sshd[173688]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.192.46.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.192.46.49
country_id: 2542007
description:
Jul 13 21:47:20 servidor sshd[173688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.192.46.49  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 103.187.147.165
country_id: 1643084
description:
Jul 13 21:47:39 servidor sshd[173850]: Failed password for root from 103.187.147.165 port 35706 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.67.78.166
country_id: 1643084
description:
Jul 13 21:48:11 servidor sshd[174020]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.67.78.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.67.78.166
country_id: 1643084
description:
Jul 13 21:48:11 servidor sshd[174020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.67.78.166  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 98.70.127.17
country_id: 1269750
description:
Jul 13 21:48:34 servidor sshd[174160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.70.127.17  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.147.165
country_id: 1643084
description:
Jul 13 21:49:01 servidor sshd[174268]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.187.147.165 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.187.147.165
country_id: 1643084
description:
Jul 13 21:49:01 servidor sshd[174268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.187.147.165  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 103.187.147.165
country_id: 1643084
description:
Jul 13 21:49:02 servidor sshd[174268]: Failed password for root from 103.187.147.165 port 39296 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.70.127.17
country_id: 1269750
description:
Jul 13 21:48:34 servidor sshd[174160]: pam_imunify(sshd:auth): [IM360_RBL] The IP 98.70.127.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.77.162
country_id: 878675
description:
Jul 13 21:48:51 servidor sshd[174239]: pam_imunify(sshd:auth): [IM360_RBL] The IP 41.78.77.162 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.78.77.162
country_id: 878675
description:
Jul 13 21:48:51 servidor sshd[174239]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.78.77.162  user=ftp


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.202.8.134
country_id: 130758
description:
Jul 13 21:49:42 servidor sshd[174621]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.202.8.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.202.8.134
country_id: 130758
description:
Jul 13 21:49:42 servidor sshd[174621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.202.8.134


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.193.190.165
country_id: 1643084
description:
Jul 13 21:51:04 servidor sshd[175059]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.193.190.165 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.193.190.165
country_id: 1643084
description:
Jul 13 21:51:04 servidor sshd[175059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.193.190.165  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 21:51:15 servidor sshd[175095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 21:51:46 servidor sshd[175199]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 21:51:46 servidor sshd[175199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.23.54
country_id: 2635167
description:
Jul 13 21:51:09 servidor sshd[175083]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.23.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.23.54
country_id: 2635167
description:
Jul 13 21:51:09 servidor sshd[175083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.23.54  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 21:51:15 servidor sshd[175095]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.38.121.43
country_id: 1835841
description:
Jul 13 21:51:39 servidor sshd[175194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.38.121.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.38.121.43
country_id: 1835841
description:
Jul 13 21:51:39 servidor sshd[175194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.38.121.43


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 116.193.190.165
country_id: 1643084
description:
Jul 13 21:51:06 servidor sshd[175059]: Failed password for root from 116.193.190.165 port 50002 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.193.190.165
country_id: 1643084
description:
Jul 13 21:52:31 servidor sshd[175301]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.193.190.165 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.193.190.165
country_id: 1643084
description:
Jul 13 21:52:31 servidor sshd[175301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.193.190.165  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 116.193.190.165
country_id: 1643084
description:
Jul 13 21:52:34 servidor sshd[175301]: Failed password for root from 116.193.190.165 port 35716 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.202.8.134
country_id: 130758
description:
Jul 13 21:55:04 servidor sshd[176165]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.202.8.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.202.8.134
country_id: 130758
description:
Jul 13 21:55:04 servidor sshd[176165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.202.8.134


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.202.8.134
country_id: 130758
description:
Jul 13 21:55:06 servidor sshd[176165]: Failed password for invalid user sftpuser from 5.202.8.134 port 44948 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.164.208.189
country_id: 1814991
description:
2025-07-13 21:55:19 dovecot_login authenticator failed for ([60.164.208.189]) [60.164.208.189]:54266: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.8.143
country_id: 1668284
description:
2025-07-13 21:55:38 dovecot_login authenticator failed for 111-70-8-143.emome-ip.hinet.net [111.70.8.143]:54937: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.202.8.134
country_id: 130758
description:
Jul 13 21:56:42 servidor sshd[176456]: Failed password for invalid user sonarr from 5.202.8.134 port 47764 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.202.8.134
country_id: 130758
description:
Jul 13 21:56:40 servidor sshd[176456]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.202.8.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.202.8.134
country_id: 130758
description:
Jul 13 21:56:40 servidor sshd[176456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.202.8.134


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.170.129.195
country_id: 1605651
description:
Jul 13 21:58:07 servidor sshd[176866]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.170.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.170.129.195
country_id: 1605651
description:
Jul 13 21:58:07 servidor sshd[176866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.170.129.195


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 21:59:48 servidor sshd[177417]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.161.172.215
country_id: 2077456
description:
Jul 13 21:59:29 servidor sshd[177318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.172.215


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 22:00:17 servidor sshd[177820]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 22:00:17 servidor sshd[177820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 22:02:49 servidor sshd[179684]: Failed password for redestreamhost from 82.151.65.155 port 35922 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 22:02:46 servidor sshd[179684]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 22:02:46 servidor sshd[179684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=redestreamhost


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 22:05:21 servidor sshd[180495]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 22:06:40 -0300] info [cpaneld] 185.243.96.5 - Alexander "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Alexander (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.16.87
country_id: 290557
description:
2025-07-13 22:06:56 dovecot_login authenticator failed for ([91.74.16.87]) [91.74.16.87]:33776: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.193.204.108
country_id: 2017370
description:
2025-07-13 22:07:21 dovecot_login authenticator failed for (host-185-193-204-108.sibmediafon.ru) [185.193.204.108]:49672: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.12.204.239
country_id: 2960313
description:
Jul 13 22:08:14 servidor sshd[181098]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.12.204.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.12.204.239
country_id: 2960313
description:
Jul 13 22:08:14 servidor sshd[181098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.12.204.239


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.108.192
country_id: 3017382
description:
Jul 13 22:08:27 servidor sshd[181319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.108.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.108.192
country_id: 3017382
description:
Jul 13 22:08:27 servidor sshd[181319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.108.192  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 22:09:08 servidor sshd[181500]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.90.222.0
country_id: 2921044
description:
Jul 13 22:10:25 servidor sshd[181973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.90.222.0  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.90.222.0
country_id: 2921044
description:
Jul 13 22:10:25 servidor sshd[181973]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.90.222.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.215.41.25
country_id: 1814991
description:
2025-07-13 22:13:17 dovecot_login authenticator failed for ([222.215.41.25]) [222.215.41.25]:60894: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 22:15:18 servidor sshd[183622]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 22:17:27 servidor sshd[185558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 22:17:27 servidor sshd[185558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 22:21:00 servidor sshd[186394]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.77.99
country_id: 2921044
description:
Jul 13 22:21:18 servidor sshd[186645]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.220.77.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.220.77.99
country_id: 2921044
description:
Jul 13 22:21:18 servidor sshd[186645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.220.77.99  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.65.121.222
country_id: 3017382
description:
Jul 13 22:24:49 servidor sshd[187542]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.65.121.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.65.121.222
country_id: 3017382
description:
Jul 13 22:24:49 servidor sshd[187542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.65.121.222


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 22:25:15 servidor sshd[187745]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 22:25:15 servidor sshd[187745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.54.37
country_id: 1880251
description:
[2025-07-13 22:28:12 -0300] info [cpaneld] 159.223.54.37 - distakecom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user distakecom (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.247.160.143
country_id: 2921044
description:
Jul 13 22:29:53 servidor sshd[188707]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.247.160.143 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.247.160.143
country_id: 2921044
description:
Jul 13 22:29:53 servidor sshd[188707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.247.160.143


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 22:31:33 servidor sshd[190865]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 22:31:33 servidor sshd[190865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.241.125.180
country_id: 6252001
description:
Jul 13 22:32:12 servidor sshd[191139]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.241.125.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.241.125.180
country_id: 6252001
description:
Jul 13 22:32:12 servidor sshd[191139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.125.180


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 22:34:27 servidor sshd[191583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.81


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 22:34:39 servidor sshd[191620]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 22:34:39 servidor sshd[191620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.103.34.243
country_id: 298795
description:
Jul 13 22:34:05 servidor sshd[191493]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.103.34.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 22:34:27 servidor sshd[191583]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.111.118
country_id: 1562822
description:
Jul 13 22:34:34 servidor sshd[191597]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.95.111.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.95.111.118
country_id: 1562822
description:
Jul 13 22:34:34 servidor sshd[191597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.111.118


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.103.34.243
country_id: 298795
description:
Jul 13 22:34:05 servidor sshd[191493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.103.34.243


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 22:35:43 -0300] info [cpaneld] 185.243.96.5 - Timothy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Timothy (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.240.5.181
country_id: 1814991
description:
2025-07-13 22:38:03 dovecot_login authenticator failed for ([222.240.5.181]) [222.240.5.181]:39896: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 22:38:18 servidor sshd[192588]: Invalid user radiomusicclassicsfm from 92.118.39.34 port 40350


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 22:38:18 servidor sshd[192588]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 22:38:18 servidor sshd[192588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
country_id: 3469034
description:
2025-07-13 22:38:16 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:25869: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.110.157.47
country_id: 2750405
description:
Jul 13 22:39:33 servidor sshd[192936]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.110.157.47 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.110.157.47
country_id: 2750405
description:
Jul 13 22:39:33 servidor sshd[192936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.110.157.47


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 22:43:41 servidor sshd[194005]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 22:43:41 servidor sshd[194005]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 22:44:26 servidor sshd[194138]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.23.198.67
country_id: 1643084
description:
Jul 13 22:44:25 servidor sshd[194133]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.23.198.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.23.198.67
country_id: 1643084
description:
Jul 13 22:44:25 servidor sshd[194133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.23.198.67  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.71.204.253
country_id: 1880251
description:
Jul 13 22:45:00 servidor sshd[194244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.204.253  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
country_id: 3996063
description:
Jul 13 22:44:07 servidor sshd[194106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 13 22:44:08 servidor sshd[194108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.83  user=mumbacafm


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 187.237.178.130
country_id: 3996063
description:
Jul 13 22:44:09 servidor sshd[194106]: Failed password for root from 187.237.178.130 port 39285 ssh2


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 13 22:44:10 servidor sshd[194108]: Failed password for mumbacafm from 92.118.39.83 port 53644 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.71.204.253
country_id: 1880251
description:
Jul 13 22:45:00 servidor sshd[194244]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.71.204.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
country_id: 3996063
description:
Jul 13 22:44:07 servidor sshd[194106]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 13 22:44:08 servidor sshd[194108]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.26.96.232
country_id: 6252001
description:
Jul 13 22:45:25 servidor sshd[195625]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.26.96.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.26.96.232
country_id: 6252001
description:
Jul 13 22:45:25 servidor sshd[195625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.26.96.232  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-07-13 22:45:46 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:40916: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.100.72.140
country_id: 2017370
description:
2025-07-13 22:45:56 dovecot_login authenticator failed for ([92.100.72.140]) [92.100.72.140]:38328: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.227.213.240
country_id: 6252001
description:
Jul 13 22:46:21 servidor sshd[196100]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.227.213.240 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.227.213.240
country_id: 6252001
description:
Jul 13 22:46:21 servidor sshd[196100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.227.213.240  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 192.227.213.240
country_id: 6252001
description:
Jul 13 22:46:23 servidor sshd[196100]: Failed password for root from 192.227.213.240 port 42090 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.213.129.46
country_id: 1814991
description:
Jul 13 22:46:46 servidor sshd[196208]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.213.129.46 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.213.129.46
country_id: 1814991
description:
Jul 13 22:46:46 servidor sshd[196208]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.213.129.46  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
country_id: 1562822
description:
Jul 13 22:47:54 servidor sshd[196407]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
country_id: 1562822
description:
Jul 13 22:47:54 servidor sshd[196407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.227.213.240
country_id: 6252001
description:
Jul 13 22:48:31 servidor sshd[196661]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.227.213.240 has been locked due to Imunify RBL


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 192.227.213.240
country_id: 6252001
description:
Jul 13 22:48:33 servidor sshd[196661]: Failed password for root from 192.227.213.240 port 47538 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.71.204.253
country_id: 1880251
description:
Jul 13 22:48:15 servidor sshd[196629]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.71.204.253 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.71.204.253
country_id: 1880251
description:
Jul 13 22:48:15 servidor sshd[196629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.204.253  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.153.241
country_id: 1880251
description:
Jul 13 22:49:00 servidor sshd[196789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.153.241


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.227.213.240
country_id: 6252001
description:
Jul 13 22:48:31 servidor sshd[196661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.227.213.240  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.153.241
country_id: 1880251
description:
Jul 13 22:49:00 servidor sshd[196789]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.153.241 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 149.12.247.56
country_id: 2750405
description:
Jul 13 22:49:41 servidor sshd[197005]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.12.247.56  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.227.213.240
country_id: 6252001
description:
Jul 13 22:49:44 servidor sshd[197010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.227.213.240  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 192.227.213.240
country_id: 6252001
description:
Jul 13 22:49:46 servidor sshd[197010]: Failed password for root from 192.227.213.240 port 37950 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.23.198.67
country_id: 1643084
description:
Jul 13 22:49:18 servidor sshd[196876]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.23.198.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.71.204.253
country_id: 1880251
description:
Jul 13 22:49:37 servidor sshd[196916]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.71.204.253 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.71.204.253
country_id: 1880251
description:
Jul 13 22:49:37 servidor sshd[196916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.204.253  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.227.213.240
country_id: 6252001
description:
Jul 13 22:49:44 servidor sshd[197010]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.227.213.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.213.129.46
country_id: 1814991
description:
Jul 13 22:49:49 servidor sshd[197028]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.213.129.46 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.23.198.67
country_id: 1643084
description:
Jul 13 22:49:18 servidor sshd[196876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.23.198.67  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.12.247.56
country_id: 2750405
description:
Jul 13 22:49:41 servidor sshd[197005]: pam_imunify(sshd:auth): [IM360_RBL] The IP 149.12.247.56 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.213.129.46
country_id: 1814991
description:
Jul 13 22:49:49 servidor sshd[197028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.213.129.46  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 22:50:33 servidor sshd[197300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.23.198.67
country_id: 1643084
description:
Jul 13 22:50:48 servidor sshd[197381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.23.198.67  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.226.134
country_id: 6252001
description:
Jul 13 22:50:22 servidor sshd[197288]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.169.226.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.169.226.134
country_id: 6252001
description:
Jul 13 22:50:22 servidor sshd[197288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.226.134  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.23.198.67
country_id: 1643084
description:
Jul 13 22:50:48 servidor sshd[197381]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.23.198.67 has been locked due to Imunify RBL


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 192.169.226.134
country_id: 6252001
description:
Jul 13 22:50:24 servidor sshd[197288]: Failed password for root from 192.169.226.134 port 40406 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 22:50:33 servidor sshd[197300]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.213.129.46
country_id: 1814991
description:
Jul 13 22:52:02 servidor sshd[197653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.213.129.46  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.213.129.46
country_id: 1814991
description:
Jul 13 22:52:02 servidor sshd[197653]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.213.129.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 22:52:34 servidor sshd[197780]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 22:52:34 servidor sshd[197780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.81  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 22:52:36 servidor sshd[197780]: Failed password for redestreamhost from 92.118.39.81 port 47448 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
country_id: 1835841
description:
Jul 13 22:52:59 servidor sshd[197908]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
country_id: 1835841
description:
Jul 13 22:52:59 servidor sshd[197908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 116.122.157.193
country_id: 1835841
description:
Jul 13 22:53:01 servidor sshd[197908]: Failed password for root from 116.122.157.193 port 57056 ssh2


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 22:53:27 servidor sshd[198005]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.61.162.81
country_id: 6252001
description:
Jul 13 22:55:17 servidor sshd[198661]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.61.162.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.61.162.81
country_id: 6252001
description:
Jul 13 22:55:17 servidor sshd[198661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.61.162.81


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-07-13 22:58:03 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:57718: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 22:58:16 servidor sshd[199320]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 22:58:16 servidor sshd[199320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-07-13 22:58:29 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:48570: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.128.112.74
country_id: 732800
description:
Jul 13 22:58:52 servidor sshd[199562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.128.112.74


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 22:59:14 servidor sshd[199658]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 22:59:14 servidor sshd[199658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.36.83.126
country_id: 3469034
description:
Jul 13 23:00:41 servidor sshd[201473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.36.83.126


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.180.255.136
country_id: 6252001
description:
Jul 13 23:00:45 servidor sshd[201477]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.180.255.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.180.255.136
country_id: 6252001
description:
Jul 13 23:00:45 servidor sshd[201477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.180.255.136


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.83.126
country_id: 3469034
description:
Jul 13 23:00:41 servidor sshd[201473]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.36.83.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 23:04:43 -0300] info [cpaneld] 185.243.96.5 - Richard "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Richard (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.130.95.240
country_id: 1835841
description:
Jul 13 23:08:32 servidor sshd[203393]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.130.95.240 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.130.95.240
country_id: 1835841
description:
Jul 13 23:08:32 servidor sshd[203393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.130.95.240


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 149.12.247.25
country_id: 2750405
description:
Jul 13 23:09:34 servidor sshd[203970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.12.247.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.22.210.132
country_id: 3469034
description:
2025-07-13 23:09:07 dovecot_login authenticator failed for ([144.22.210.132]) [144.22.210.132]:49394: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.12.247.25
country_id: 2750405
description:
Jul 13 23:09:34 servidor sshd[203970]: pam_imunify(sshd:auth): [IM360_RBL] The IP 149.12.247.25 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 23:11:44 servidor sshd[204576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.246.224.218  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 23:11:46 servidor sshd[204576]: Failed password for root from 106.246.224.218 port 57098 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.89.127.232
country_id: 2921044
description:
Jul 13 23:12:38 servidor sshd[204775]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.89.127.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.89.127.232
country_id: 2921044
description:
Jul 13 23:12:38 servidor sshd[204775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.89.127.232  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.216.192.61
country_id: 2017370
description:
Jul 13 23:14:39 servidor sshd[205312]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.216.192.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.216.192.61
country_id: 2017370
description:
Jul 13 23:14:39 servidor sshd[205312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.216.192.61  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.213.238.91
country_id: 1210997
description:
Jul 13 23:16:46 servidor sshd[207315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.213.238.91  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.21.191
country_id: 1562822
description:
Jul 13 23:16:26 servidor sshd[207268]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.253.21.191 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.253.21.191
country_id: 1562822
description:
Jul 13 23:16:26 servidor sshd[207268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.253.21.191


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.53.93
country_id: 1819730
description:
Jul 13 23:17:35 servidor sshd[207512]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.53.93 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.53.93
country_id: 1819730
description:
Jul 13 23:17:35 servidor sshd[207512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.53.93


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.91.112
country_id: 1880251
description:
Jul 13 23:18:26 servidor sshd[207710]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.172.91.112 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.172.91.112
country_id: 1880251
description:
Jul 13 23:18:26 servidor sshd[207710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.91.112


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.208.108.166
country_id: 1819730
description:
Jul 13 23:18:07 servidor sshd[207642]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.208.108.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.208.108.166
country_id: 1819730
description:
Jul 13 23:18:07 servidor sshd[207642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.208.108.166  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 104.208.108.166
country_id: 1819730
description:
Jul 13 23:18:09 servidor sshd[207642]: Failed password for root from 104.208.108.166 port 45904 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.253.21.191
country_id: 1562822
description:
Jul 13 23:19:09 servidor sshd[208004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.253.21.191


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.208.108.166
country_id: 1819730
description:
Jul 13 23:19:29 servidor sshd[208038]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.208.108.166 has been locked due to Imunify RBL


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 104.208.108.166
country_id: 1819730
description:
Jul 13 23:19:31 servidor sshd[208038]: Failed password for root from 104.208.108.166 port 63830 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.53.93
country_id: 1819730
description:
Jul 13 23:19:49 servidor sshd[208079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.53.93


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.208.108.166
country_id: 1819730
description:
Jul 13 23:19:29 servidor sshd[208038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.208.108.166  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.53.93
country_id: 1819730
description:
Jul 13 23:19:49 servidor sshd[208079]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.53.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.21.191
country_id: 1562822
description:
Jul 13 23:19:09 servidor sshd[208004]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.253.21.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.24.28.34
country_id: 2017370
description:
Jul 13 23:19:12 servidor sshd[208009]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.24.28.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.24.28.34
country_id: 2017370
description:
Jul 13 23:19:12 servidor sshd[208009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.24.28.34  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.167.38.134
country_id: 6252001
description:
Jul 13 23:20:46 servidor sshd[208481]: pam_imunify(sshd:auth): [IM360_RBL] The IP 72.167.38.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 72.167.38.134
country_id: 6252001
description:
Jul 13 23:20:46 servidor sshd[208481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.38.134


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.208.108.166
country_id: 1819730
description:
Jul 13 23:20:49 servidor sshd[208484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.208.108.166  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.213.238.91
country_id: 1210997
description:
Jul 13 23:20:27 servidor sshd[208375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.213.238.91  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.253.21.191
country_id: 1562822
description:
Jul 13 23:20:35 servidor sshd[208384]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.253.21.191 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.253.21.191
country_id: 1562822
description:
Jul 13 23:20:35 servidor sshd[208384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.253.21.191


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.253.21.191
country_id: 1562822
description:
Jul 13 23:20:38 servidor sshd[208384]: Failed password for invalid user vpnuser from 103.253.21.191 port 59626 ssh2


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 104.208.108.166
country_id: 1819730
description:
Jul 13 23:20:50 servidor sshd[208484]: Failed password for root from 104.208.108.166 port 30438 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.238.91
country_id: 1210997
description:
Jul 13 23:20:27 servidor sshd[208375]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.213.238.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.208.108.166
country_id: 1819730
description:
Jul 13 23:20:49 servidor sshd[208484]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.208.108.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.53.93
country_id: 1819730
description:
Jul 13 23:21:17 servidor sshd[208668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.53.93


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.238.91
country_id: 1210997
description:
Jul 13 23:21:58 servidor sshd[208771]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.213.238.91 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.213.238.91
country_id: 1210997
description:
Jul 13 23:21:58 servidor sshd[208771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.213.238.91  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.24.28.34
country_id: 2017370
description:
Jul 13 23:21:08 servidor sshd[208607]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.24.28.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.53.93
country_id: 1819730
description:
Jul 13 23:21:17 servidor sshd[208668]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.53.93 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.24.28.34
country_id: 2017370
description:
Jul 13 23:21:08 servidor sshd[208607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.24.28.34  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.24.28.34
country_id: 2017370
description:
Jul 13 23:22:17 servidor sshd[208935]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.24.28.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.24.28.34
country_id: 2017370
description:
Jul 13 23:22:17 servidor sshd[208935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.24.28.34  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 23:23:09 servidor sshd[209143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 23:23:09 servidor sshd[209143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 23:25:49 servidor sshd[209922]: Invalid user radioitaboraisantos from 92.118.39.37 port 33214


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 23:25:50 servidor sshd[209922]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 23:25:50 servidor sshd[209922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.37


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 23:26:06 servidor sshd[210011]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2025-07-13 23:26:56 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:5016: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.254
country_id: 1814991
description:
2025-07-13 23:27:16 dovecot_login authenticator failed for ([111.26.95.253]) [111.26.95.254]:37000: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.96.44.58
country_id: 1814991
description:
2025-07-13 23:28:20 dovecot_login authenticator failed for ([36.96.44.58]) [36.96.44.58]:60235: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.127
country_id: 1814991
description:
2025-07-13 23:28:34 dovecot_login authenticator failed for ([222.128.15.127]) [222.128.15.127]:40476: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.96.243.157
country_id: 1512440
description:
Jul 13 23:32:17 servidor sshd[212873]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.96.243.157 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.96.243.157
country_id: 1512440
description:
Jul 13 23:32:17 servidor sshd[212873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.96.243.157


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.36.253
country_id: 2921044
description:
Jul 13 23:32:54 servidor sshd[212975]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.36.253 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.36.253
country_id: 2921044
description:
Jul 13 23:32:54 servidor sshd[212975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.36.253  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 23:33:06 servidor sshd[213053]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 23:33:06 servidor sshd[213053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 23:33:50 -0300] info [cpaneld] 185.243.96.5 - Zachary "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Zachary (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 23:35:18 servidor sshd[213751]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 23:35:18 servidor sshd[213751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.156.22.114
country_id: 798549
description:
Jul 13 23:36:00 servidor sshd[214077]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.156.22.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.156.22.114
country_id: 798549
description:
Jul 13 23:36:00 servidor sshd[214077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.156.22.114


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.234.220.212
country_id: 6252001
description:
Jul 13 23:37:19 servidor sshd[214358]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.234.220.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.234.220.212
country_id: 6252001
description:
Jul 13 23:37:19 servidor sshd[214358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.234.220.212


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.91.0.68
country_id: 2750405
description:
Jul 13 23:41:07 servidor sshd[215430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.91.0.68  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.91.0.68
country_id: 2750405
description:
Jul 13 23:41:07 servidor sshd[215430]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.91.0.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 123.58.212.64
country_id: 1819730
description:
Jul 13 23:42:14 servidor sshd[215631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.58.212.64  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.245.107.230
country_id: 2264397
description:
Jul 13 23:42:07 servidor sshd[215624]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.245.107.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.245.107.230
country_id: 2264397
description:
Jul 13 23:42:07 servidor sshd[215624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.245.107.230  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.58.212.64
country_id: 1819730
description:
Jul 13 23:42:14 servidor sshd[215631]: pam_imunify(sshd:auth): [IM360_RBL] The IP 123.58.212.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 23:43:57 servidor sshd[216011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.37


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.129.183.0
country_id: 2077456
description:
Jul 13 23:43:24 servidor sshd[215873]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.129.183.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.48.147.13
country_id: 1814991
description:
Jul 13 23:43:25 servidor sshd[215875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.48.147.13  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.126.101.102
country_id: 6252001
description:
Jul 13 23:43:25 servidor sshd[215881]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.126.101.102 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 23:43:57 servidor sshd[216011]: Invalid user radiomusicclassicsfm from 92.118.39.37 port 48994


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.152.122
country_id: 6252001
description:
Jul 13 23:43:07 servidor sshd[215834]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.136.152.122 has been locked due to Imunify RBL


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 150.136.152.122
country_id: 6252001
description:
Jul 13 23:43:09 servidor sshd[215834]: Failed password for root from 150.136.152.122 port 60084 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.129.183.0
country_id: 2077456
description:
Jul 13 23:43:24 servidor sshd[215873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.129.183.0  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 23:43:57 servidor sshd[216011]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.136.152.122
country_id: 6252001
description:
Jul 13 23:43:07 servidor sshd[215834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.136.152.122  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.67.208.20
country_id: 6252001
description:
Jul 13 23:43:41 servidor sshd[215971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.67.208.20


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.126.101.102
country_id: 6252001
description:
Jul 13 23:43:25 servidor sshd[215881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.126.101.102


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 104.234.220.213
country_id: 6252001
description:
Jul 13 23:44:35 servidor sshd[216154]: Failed password for root from 104.234.220.213 port 44414 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.91.0.68
country_id: 2750405
description:
Jul 13 23:44:36 servidor sshd[216175]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.91.0.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.91.0.68
country_id: 2750405
description:
Jul 13 23:44:36 servidor sshd[216175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.91.0.68  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.50.177.48
country_id: 1562822
description:
Jul 13 23:44:06 servidor sshd[216068]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.50.177.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.50.177.48
country_id: 1562822
description:
Jul 13 23:44:06 servidor sshd[216068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.50.177.48  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.234.220.213
country_id: 6252001
description:
Jul 13 23:44:34 servidor sshd[216154]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.234.220.213 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.234.220.213
country_id: 6252001
description:
Jul 13 23:44:34 servidor sshd[216154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.234.220.213  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.245.107.230
country_id: 2264397
description:
Jul 13 23:45:58 servidor sshd[218074]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.245.107.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.152.122
country_id: 6252001
description:
Jul 13 23:45:14 servidor sshd[216412]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.136.152.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 23:45:29 servidor sshd[217920]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 123.58.212.64
country_id: 1819730
description:
Jul 13 23:45:33 servidor sshd[217973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.58.212.64  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.91.0.68
country_id: 2750405
description:
Jul 13 23:45:42 servidor sshd[218008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.91.0.68  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 150.136.152.122
country_id: 6252001
description:
Jul 13 23:45:16 servidor sshd[216412]: Failed password for root from 150.136.152.122 port 62446 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.129.183.0
country_id: 2077456
description:
Jul 13 23:45:43 servidor sshd[218006]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.129.183.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.245.107.230
country_id: 2264397
description:
Jul 13 23:45:58 servidor sshd[218074]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.245.107.230  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.136.152.122
country_id: 6252001
description:
Jul 13 23:45:14 servidor sshd[216412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.136.152.122  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 23:45:29 servidor sshd[217920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.58.212.64
country_id: 1819730
description:
Jul 13 23:45:33 servidor sshd[217973]: pam_imunify(sshd:auth): [IM360_RBL] The IP 123.58.212.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.91.0.68
country_id: 2750405
description:
Jul 13 23:45:42 servidor sshd[218008]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.91.0.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.129.183.0
country_id: 2077456
description:
Jul 13 23:45:43 servidor sshd[218006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.129.183.0  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.58.212.64
country_id: 1819730
description:
Jul 13 23:46:54 servidor sshd[218457]: pam_imunify(sshd:auth): [IM360_RBL] The IP 123.58.212.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 123.58.212.64
country_id: 1819730
description:
Jul 13 23:46:54 servidor sshd[218457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.58.212.64  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.76
country_id: 1835841
description:
2025-07-13 23:47:01 dovecot_login authenticator failed for ([14.37.206.76]) [14.37.206.76]:52813: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.136.152.122
country_id: 6252001
description:
Jul 13 23:46:24 servidor sshd[218296]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.136.152.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.136.152.122
country_id: 6252001
description:
Jul 13 23:46:24 servidor sshd[218296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.136.152.122  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 150.136.152.122
country_id: 6252001
description:
Jul 13 23:46:26 servidor sshd[218296]: Failed password for root from 150.136.152.122 port 57710 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.245.107.230
country_id: 2264397
description:
Jul 13 23:47:11 servidor sshd[218566]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.245.107.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.129.183.0
country_id: 2077456
description:
Jul 13 23:47:13 servidor sshd[218570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.129.183.0  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 23:47:52 servidor sshd[218771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.245.107.230
country_id: 2264397
description:
Jul 13 23:47:11 servidor sshd[218566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.245.107.230  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.129.183.0
country_id: 2077456
description:
Jul 13 23:47:13 servidor sshd[218570]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.129.183.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-07-13 23:47:15 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:37207: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 23:47:52 servidor sshd[218771]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.95.231.219
country_id: 1835841
description:
2025-07-13 23:49:14 dovecot_login authenticator failed for ([210.95.231.219]) [210.95.231.219]:41128: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.172.32.246
country_id: 1814991
description:
Jul 13 23:49:22 servidor sshd[219082]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.172.32.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.172.32.246
country_id: 1814991
description:
Jul 13 23:49:22 servidor sshd[219082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.172.32.246  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.129.12
country_id: 2029969
description:
2025-07-13 23:49:34 dovecot_login authenticator failed for ([49.0.129.12]) [49.0.129.12]:45116: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
country_id: 1814991
description:
Jul 13 23:49:38 servidor sshd[219186]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
country_id: 1814991
description:
Jul 13 23:49:38 servidor sshd[219186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.48.147.13
country_id: 1814991
description:
Jul 13 23:50:48 servidor sshd[219530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.48.147.13  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 23:53:15 servidor sshd[220161]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 23:53:15 servidor sshd[220161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.37  user=mumbacafm


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 23:53:17 servidor sshd[220161]: Failed password for mumbacafm from 92.118.39.37 port 36034 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.172.32.246
country_id: 1814991
description:
Jul 13 23:53:59 servidor sshd[220315]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.172.32.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.172.32.246
country_id: 1814991
description:
Jul 13 23:53:59 servidor sshd[220315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.172.32.246  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 23:54:04 servidor sshd[220361]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.172.32.246
country_id: 1814991
description:
Jul 13 23:57:16 servidor sshd[221240]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.172.32.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.172.32.246
country_id: 1814991
description:
Jul 13 23:57:16 servidor sshd[221240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.172.32.246  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.48.147.13
country_id: 1814991
description:
Jul 13 23:58:21 servidor sshd[221483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.48.147.13  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.144.87.77
country_id: 6252001
description:
Jul 14 00:01:40 servidor sshd[224138]: pam_imunify(sshd:auth): [IM360_RBL] The IP 24.144.87.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 24.144.87.77
country_id: 6252001
description:
Jul 14 00:01:40 servidor sshd[224138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.144.87.77


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.63
country_id: 2635167
description:
Jul 14 00:02:37 servidor dovecot[145610]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.63, lip=69.30.198.26, TLS, session=<4OpZ5No5oeq594k/>


