# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-14 00:02:57 -0300] info [cpaneld] 185.243.96.5 - Charles "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Charles (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 14 00:05:03 servidor sshd[225037]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 14 00:05:03 servidor sshd[225037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 00:06:55 servidor sshd[225507]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 00:06:55 servidor sshd[225507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-07-14 00:09:00 dovecot_login authenticator failed for (host253.181-93-60.telecom.net.ar) [181.93.60.253]:61665: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.228.232.17
country_id: 1814991
description:
2025-07-14 00:09:15 dovecot_login authenticator failed for ([221.228.232.17]) [221.228.232.17]:52814: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.206.12.13
country_id: 1835841
description:
Jul 14 00:09:36 servidor sshd[226423]: Invalid user radioitaboraisantos from 14.206.12.13 port 45414


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.206.12.13
country_id: 1835841
description:
Jul 14 00:09:36 servidor sshd[226423]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.206.12.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.206.12.13
country_id: 1835841
description:
Jul 14 00:09:36 servidor sshd[226423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.206.12.13


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.184
country_id: 2635167
description:
Jul 14 00:10:58 servidor dovecot[145610]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.184, lip=69.30.198.27, TLS, session=<0lZCAts5w7W594m4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 14 00:11:52 servidor sshd[226980]: Invalid user radiomusicclassicsfm from 92.118.39.83 port 36552


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 14 00:11:53 servidor sshd[226980]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 14 00:11:53 servidor sshd[226980]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.83
country_id: 1814991
description:
2025-07-14 00:12:39 dovecot_login authenticator failed for ([111.26.63.83]) [111.26.63.83]:37518: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.122
country_id: 1269750
description:
2025-07-14 00:12:23 dovecot_login authenticator failed for ([125.17.95.49]) [182.95.222.122]:53986: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.21.215
country_id: 2750405
description:
Jul 14 00:13:31 servidor sshd[227466]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.21.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 14 00:13:33 servidor sshd[227472]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.130.113.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 14 00:13:33 servidor sshd[227472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.130.113.204  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 14 00:13:35 servidor sshd[227472]: Failed password for root from 125.130.113.204 port 44690 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.130.255.8
country_id: 1643084
description:
Jul 14 00:13:43 servidor sshd[227520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.130.255.8  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 158.220.102.241
country_id: 2921044
description:
Jul 14 00:13:27 servidor sshd[227460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.220.102.241


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.21.215
country_id: 2750405
description:
Jul 14 00:13:31 servidor sshd[227466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.21.215


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.130.255.8
country_id: 1643084
description:
Jul 14 00:13:43 servidor sshd[227520]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.130.255.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.220.102.241
country_id: 2921044
description:
Jul 14 00:13:27 servidor sshd[227460]: pam_imunify(sshd:auth): [IM360_RBL] The IP 158.220.102.241 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 14 00:14:14 servidor sshd[227673]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 14 00:14:46 servidor sshd[227721]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 14 00:14:46 servidor sshd[227721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.83  user=redecast


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 14 00:14:48 servidor sshd[227721]: Failed password for redecast from 92.118.39.83 port 37356 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.18.215
country_id: 3017382
description:
Jul 14 00:15:32 servidor sshd[229523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.18.215  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.191.92.224
country_id: 1643084
description:
Jul 14 00:15:38 servidor sshd[229554]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.92.224  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 162.215.130.221
country_id: 6252001
description:
Jul 14 00:15:44 servidor sshd[229570]: Failed password for root from 162.215.130.221 port 33872 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.18.215
country_id: 3017382
description:
Jul 14 00:15:32 servidor sshd[229523]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.18.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.191.92.224
country_id: 1643084
description:
Jul 14 00:15:38 servidor sshd[229554]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.191.92.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.130.221
country_id: 6252001
description:
Jul 14 00:15:41 servidor sshd[229570]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.130.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.130.221
country_id: 6252001
description:
Jul 14 00:15:41 servidor sshd[229570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.130.221  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.88.103
country_id: 2750405
description:
Jul 14 00:17:39 servidor sshd[229917]: pam_imunify(sshd:auth): [IM360_RBL] The IP 196.251.88.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 196.251.88.103
country_id: 2750405
description:
Jul 14 00:17:39 servidor sshd[229917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.251.88.103


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.191.92.224
country_id: 1643084
description:
Jul 14 00:17:16 servidor sshd[229889]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.191.92.224 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.191.92.224
country_id: 1643084
description:
Jul 14 00:17:16 servidor sshd[229889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.92.224  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.191.92.224
country_id: 1643084
description:
Jul 14 00:18:43 servidor sshd[230284]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.191.92.224 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.191.92.224
country_id: 1643084
description:
Jul 14 00:18:43 servidor sshd[230284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.92.224  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 14 00:23:58 servidor sshd[231466]: Failed password for redestreamhost from 82.151.65.155 port 39222 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 14 00:23:56 servidor sshd[231466]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 14 00:23:56 servidor sshd[231466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=redestreamhost


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 14 00:26:40 servidor sshd[232528]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 14 00:26:40 servidor sshd[232528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
country_id: 2510769
description:
Jul 14 00:27:55 servidor sshd[232761]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
country_id: 2510769
description:
Jul 14 00:27:55 servidor sshd[232761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.221.188
country_id: 1269750
description:
Jul 14 00:27:04 servidor sshd[232606]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.78.221.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.78.221.188
country_id: 1269750
description:
Jul 14 00:27:04 servidor sshd[232606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.78.221.188  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-14 00:32:19 -0300] info [cpaneld] 185.243.96.5 - Aaron "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Aaron (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.244.35
country_id: 1562822
description:
Jul 14 00:34:36 servidor sshd[235922]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.212.244.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.244.35
country_id: 1562822
description:
Jul 14 00:34:36 servidor sshd[235922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.244.35  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.178.137.243
country_id: 3017382
description:
Jul 14 00:35:08 servidor sshd[236492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.137.243  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.137.243
country_id: 3017382
description:
Jul 14 00:35:08 servidor sshd[236492]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.178.137.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 14 00:36:15 servidor sshd[236676]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 14 00:36:15 servidor sshd[236676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-07-14 00:37:49 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:36368: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.34
country_id: 1733045
description:
2025-07-14 00:38:23 dovecot_login authenticator failed for ([49.124.146.34]) [49.124.146.34]:49904: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.144.234
country_id: 3469034
description:
Jul 14 00:39:10 servidor sshd[237266]: pam_imunify(sshd:auth): [IM360_RBL] The IP 168.196.144.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 168.196.144.234
country_id: 3469034
description:
Jul 14 00:39:10 servidor sshd[237266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.196.144.234  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 168.196.144.234
country_id: 3469034
description:
Jul 14 00:39:12 servidor sshd[237266]: Failed password for root from 168.196.144.234 port 52102 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 00:40:40 servidor sshd[237858]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 00:40:40 servidor sshd[237858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 14 00:42:07 servidor sshd[238126]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 14 00:42:07 servidor sshd[238126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 14 00:43:26 servidor sshd[238367]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 14 00:46:55 servidor sshd[240930]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.182.74.203
country_id: 798544
description:
Jul 14 00:47:48 servidor sshd[241309]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.182.74.203 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.74.203
country_id: 798544
description:
Jul 14 00:47:48 servidor sshd[241309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.74.203


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.99.243
country_id: 1880251
description:
Jul 14 00:47:33 servidor sshd[241077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.99.243  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 14 00:48:19 servidor sshd[241465]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 14 00:48:19 servidor sshd[241465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.156.209
country_id: 1835841
description:
2025-07-14 00:48:40 dovecot_login authenticator failed for ([119.207.156.209]) [119.207.156.209]:10486: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2025-07-14 00:48:52 dovecot_login authenticator failed for ([203.192.247.84]) [203.192.247.84]:37616: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.102.63
country_id: 1880251
description:
Jul 14 00:49:01 servidor sshd[241599]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.102.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.102.63
country_id: 1880251
description:
Jul 14 00:49:01 servidor sshd[241599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.102.63  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 14 00:48:19 servidor sshd[241465]: Invalid user radioitaboraisantos from 92.118.39.115 port 46462


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Jul 14 00:56:23 servidor sshd[243589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 175.125.95.234
country_id: 1835841
description:
Jul 14 00:56:25 servidor sshd[243589]: Failed password for redestreamhost from 175.125.95.234 port 42268 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Jul 14 00:56:23 servidor sshd[243589]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
country_id: 2661886
description:
2025-07-14 00:59:23 dovecot_login authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:37816: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
country_id: 2017370
description:
2025-07-14 00:59:34 dovecot_login authenticator failed for ([77.87.103.131]) [77.87.103.131]:44446: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 14 01:00:35 servidor sshd[246300]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 14 01:00:35 servidor sshd[246300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.115


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 14 01:01:29 servidor sshd[246617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.65  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-14 01:01:59 -0300] info [cpaneld] 185.243.96.5 - Adam "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Adam (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 14 01:01:29 servidor sshd[246617]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.201.4.38
country_id: 458258
description:
Jul 14 01:02:34 servidor sshd[246801]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.201.4.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 89.201.4.38
country_id: 458258
description:
Jul 14 01:02:34 servidor sshd[246801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.201.4.38  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.1.60.243
country_id: 1605651
description:
Jul 14 01:03:39 servidor sshd[247039]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.1.60.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.1.60.243
country_id: 1605651
description:
Jul 14 01:03:39 servidor sshd[247039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.1.60.243  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 14 01:07:25 servidor sshd[248348]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 14 01:07:56 servidor sshd[248452]: pam_imunify(sshd:auth): [IM360_RBL] The IP 1.226.84.145 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 14 01:07:56 servidor sshd[248452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.226.84.145  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.128.112.74
country_id: 732800
description:
Jul 14 01:07:12 servidor sshd[248323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.128.112.74


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.141.21.181
country_id: 1814991
description:
Jul 14 01:07:53 servidor sshd[248433]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.141.21.181 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.141.21.181
country_id: 1814991
description:
Jul 14 01:07:53 servidor sshd[248433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.141.21.181


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 14 01:08:36 servidor sshd[248553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.83


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.83
country_id: 6252001
description:
Jul 14 01:08:36 servidor sshd[248553]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
country_id: 1835841
description:
Jul 14 01:09:05 servidor sshd[248738]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
country_id: 1835841
description:
Jul 14 01:09:06 servidor sshd[248738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.252.88.239
country_id: 2921044
description:
Jul 14 01:10:10 servidor sshd[249077]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.252.88.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.252.88.239
country_id: 2921044
description:
Jul 14 01:10:10 servidor sshd[249077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.252.88.239  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.143.21.128
country_id: 2017370
description:
2025-07-14 01:10:20 dovecot_login authenticator failed for ([45.143.21.128]) [45.143.21.128]:55532: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
country_id: 2661886
description:
2025-07-14 01:10:30 dovecot_login authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:34414: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.141.21.181
country_id: 1814991
description:
Jul 14 01:11:37 servidor sshd[249283]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.141.21.181 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.141.21.181
country_id: 1814991
description:
Jul 14 01:11:37 servidor sshd[249283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.141.21.181


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.45.143.159
country_id: 1814991
description:
Jul 14 01:11:33 servidor sshd[249259]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.45.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.45.143.159
country_id: 1814991
description:
Jul 14 01:11:33 servidor sshd[249259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.143.159  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.62.169
country_id: 6252001
description:
Jul 14 01:13:27 servidor sshd[250292]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.161.62.169 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.161.62.169
country_id: 6252001
description:
Jul 14 01:13:27 servidor sshd[250292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.161.62.169


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.141.21.181
country_id: 1814991
description:
Jul 14 01:13:08 servidor sshd[250046]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.141.21.181 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.141.21.181
country_id: 1814991
description:
Jul 14 01:13:08 servidor sshd[250046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.141.21.181


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.141.21.181
country_id: 1814991
description:
Jul 14 01:13:09 servidor sshd[250046]: Failed password for invalid user web from 36.141.21.181 port 57926 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 01:14:39 servidor sshd[250525]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 01:14:39 servidor sshd[250525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.124.154.83
country_id: 1880251
description:
Jul 14 01:15:51 servidor sshd[252460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.124.154.83  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.88.9
country_id: 1880251
description:
Jul 14 01:16:03 servidor sshd[252504]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.88.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.88.9
country_id: 1880251
description:
Jul 14 01:16:03 servidor sshd[252504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.88.9


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.88.9
country_id: 1880251
description:
Jul 14 01:16:05 servidor sshd[252504]: Failed password for invalid user adcolheita from 178.128.88.9 port 33436 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.22.205
country_id: 1835841
description:
2025-07-14 01:16:57 dovecot_login authenticator failed for ([211.43.22.205]) [211.43.22.205]:43856: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.174.139.107
country_id: 2017370
description:
2025-07-14 01:17:13 dovecot_login authenticator failed for ([85.174.139.107]) [85.174.139.107]:56802: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 14 01:18:16 servidor sshd[253098]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 14 01:18:16 servidor sshd[253098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.95
country_id: 6252001
description:
Jul 14 01:20:33 servidor sshd[253619]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.95
country_id: 6252001
description:
Jul 14 01:20:33 servidor sshd[253619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.95


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.130.219.128
country_id: 1562822
description:
Jul 14 01:23:48 servidor sshd[254626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.219.128  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 103.130.219.128
country_id: 1562822
description:
Jul 14 01:23:50 servidor sshd[254626]: Failed password for root from 103.130.219.128 port 42714 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.211.25.121
country_id: 3175395
description:
Jul 14 01:23:27 servidor sshd[254506]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.211.25.121 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.211.25.121
country_id: 3175395
description:
Jul 14 01:23:27 servidor sshd[254506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.25.121  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.90.149.164
country_id: 6252001
description:
Jul 14 01:23:33 servidor sshd[254526]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.90.149.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.90.149.164
country_id: 6252001
description:
Jul 14 01:23:33 servidor sshd[254526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.90.149.164  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.95
country_id: 6252001
description:
Jul 14 01:28:05 servidor sshd[255992]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.95
country_id: 6252001
description:
Jul 14 01:28:05 servidor sshd[255992]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.95


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.65.149.226
country_id: 2750405
description:
Jul 14 01:28:25 servidor sshd[256088]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.65.149.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.65.149.226
country_id: 2750405
description:
Jul 14 01:28:25 servidor sshd[256088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.65.149.226  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-14 01:31:46 -0300] info [cpaneld] 185.243.96.5 - Nathan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Nathan (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.45.143.159
country_id: 1814991
description:
Jul 14 01:32:06 servidor sshd[258778]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.45.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.45.143.159
country_id: 1814991
description:
Jul 14 01:32:06 servidor sshd[258778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.143.159  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.51.13.138
country_id: 1814991
description:
Jul 14 01:33:04 servidor sshd[258887]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.51.13.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.51.13.138
country_id: 1814991
description:
Jul 14 01:33:04 servidor sshd[258887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.51.13.138  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.51.13.138
country_id: 1814991
description:
Jul 14 01:33:27 servidor sshd[258996]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.51.13.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.51.13.138
country_id: 1814991
description:
Jul 14 01:33:27 servidor sshd[258996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.51.13.138  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.95
country_id: 6252001
description:
Jul 14 01:35:42 servidor sshd[259748]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.95
country_id: 6252001
description:
Jul 14 01:35:42 servidor sshd[259748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.95


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.11.165.119
country_id: 3017382
description:
Jul 14 01:35:58 servidor sshd[259805]: pam_imunify(sshd:auth): [IM360_RBL] The IP 141.11.165.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 141.11.165.119
country_id: 3017382
description:
Jul 14 01:35:58 servidor sshd[259805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.11.165.119


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.100.16
country_id: 1835841
description:
2025-07-14 01:35:14 dovecot_login authenticator failed for ([59.12.100.16]) [59.12.100.16]:43501: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-07-14 01:35:34 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:41784: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.38.102
country_id: 1562822
description:
Jul 14 01:40:11 servidor sshd[260995]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.38.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.38.102
country_id: 1562822
description:
Jul 14 01:40:11 servidor sshd[260995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.38.102  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.203.212
country_id: 1643084
description:
Jul 14 01:40:57 servidor sshd[261128]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.203.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.203.212
country_id: 1643084
description:
Jul 14 01:40:57 servidor sshd[261128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.203.212  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 103.146.203.212
country_id: 1643084
description:
Jul 14 01:40:59 servidor sshd[261128]: Failed password for root from 103.146.203.212 port 45336 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.77.162
country_id: 878675
description:
Jul 14 01:42:59 servidor sshd[261932]: pam_imunify(sshd:auth): [IM360_RBL] The IP 41.78.77.162 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.78.77.162
country_id: 878675
description:
Jul 14 01:42:59 servidor sshd[261932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.78.77.162


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.131.101
country_id: 1814991
description:
Jul 14 01:42:48 servidor sshd[261900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.131.101  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 101.126.131.101
country_id: 1814991
description:
Jul 14 01:42:50 servidor sshd[261900]: Failed password for root from 101.126.131.101 port 55696 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.78.77.162
country_id: 878675
description:
Jul 14 01:43:09 servidor sshd[262013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.78.77.162


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 14 01:43:13 servidor sshd[262017]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 14 01:43:13 servidor sshd[262017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.169.190.104
country_id: 6252001
description:
Jul 14 01:43:44 servidor sshd[262135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.190.104


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.77.162
country_id: 878675
description:
Jul 14 01:43:09 servidor sshd[262013]: pam_imunify(sshd:auth): [IM360_RBL] The IP 41.78.77.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.194.11.247
country_id: 2921044
description:
Jul 14 01:44:37 servidor sshd[262458]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.194.11.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.194.11.247
country_id: 2921044
description:
Jul 14 01:44:37 servidor sshd[262458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.194.11.247  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.27.36.4
country_id: 1643084
description:
Jul 14 01:44:47 servidor sshd[262476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.27.36.4  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.152.183.115
country_id: 130758
description:
Jul 14 01:44:26 servidor sshd[262374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.152.183.115  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.170.146
country_id: 1814991
description:
Jul 14 01:45:44 servidor sshd[264378]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.170.146
country_id: 1814991
description:
Jul 14 01:45:44 servidor sshd[264378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.170.146  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.194.11.247
country_id: 2921044
description:
Jul 14 01:46:40 servidor sshd[264558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.194.11.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.194.11.247
country_id: 2921044
description:
Jul 14 01:46:40 servidor sshd[264558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.194.11.247  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 01:47:52 servidor sshd[264781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.194.11.247
country_id: 2921044
description:
Jul 14 01:47:54 servidor sshd[264785]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.194.11.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.194.11.247
country_id: 2921044
description:
Jul 14 01:47:54 servidor sshd[264785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.194.11.247  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.34.212.116
country_id: 798544
description:
Jul 14 01:47:08 servidor sshd[264666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.34.212.116


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.152.183.115
country_id: 130758
description:
Jul 14 01:47:25 servidor sshd[264697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.152.183.115  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 01:47:52 servidor sshd[264781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.34.212.116
country_id: 798544
description:
Jul 14 01:47:08 servidor sshd[264666]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.34.212.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.27.36.4
country_id: 1643084
description:
Jul 14 01:47:18 servidor sshd[264686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.27.36.4  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.152.183.115
country_id: 130758
description:
Jul 14 01:48:45 servidor sshd[265034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.152.183.115  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.27.36.4
country_id: 1643084
description:
Jul 14 01:48:48 servidor sshd[265038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.27.36.4  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-07-14 01:50:56 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:50724: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-07-14 01:51:07 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:7189: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 14 01:53:51 servidor sshd[266329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 14 01:54:00 servidor sshd[266432]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.65 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 14 01:54:00 servidor sshd[266432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.65  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 14 01:53:51 servidor sshd[266329]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.170.146
country_id: 1814991
description:
Jul 14 01:57:26 servidor sshd[267481]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.170.146
country_id: 1814991
description:
Jul 14 01:57:26 servidor sshd[267481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.170.146  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-14 02:01:34 -0300] info [cpaneld] 185.243.96.5 - Mark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Mark (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.227.238
country_id: 1835841
description:
2025-07-14 02:02:06 dovecot_login authenticator failed for ([221.163.227.238]) [221.163.227.238]:57933: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.240.78
country_id: 1880251
description:
2025-07-14 02:02:19 dovecot_login authenticator failed for (78.240.75.138.unknown.m1.com.sg) [138.75.240.78]:53255: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 101.126.131.101
country_id: 1814991
description:
Jul 14 02:04:25 servidor sshd[270727]: Failed password for root from 101.126.131.101 port 56624 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.170.146
country_id: 1814991
description:
Jul 14 02:04:31 servidor sshd[270732]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.170.146
country_id: 1814991
description:
Jul 14 02:04:31 servidor sshd[270732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.170.146  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.131.101
country_id: 1814991
description:
Jul 14 02:04:24 servidor sshd[270727]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.131.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.131.101
country_id: 1814991
description:
Jul 14 02:04:24 servidor sshd[270727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.131.101  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.131.101
country_id: 1814991
description:
Jul 14 02:06:10 servidor sshd[271413]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.131.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.131.101
country_id: 1814991
description:
Jul 14 02:06:10 servidor sshd[271413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.131.101  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 101.126.131.101
country_id: 1814991
description:
Jul 14 02:06:12 servidor sshd[271413]: Failed password for root from 101.126.131.101 port 47246 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.52.21.96
country_id: 6251999
description:
Jul 14 02:06:19 servidor sshd[271472]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.52.21.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.52.21.96
country_id: 6251999
description:
Jul 14 02:06:19 servidor sshd[271472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.52.21.96


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.91.86
country_id: 3017382
description:
Jul 14 02:07:49 servidor sshd[271920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.91.86  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.91.86
country_id: 3017382
description:
Jul 14 02:07:49 servidor sshd[271920]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.91.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 14 02:08:05 servidor sshd[272030]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 14 02:08:05 servidor sshd[272030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 14 02:09:15 servidor sshd[272244]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 14 02:09:15 servidor sshd[272244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 14 02:11:01 servidor sshd[272678]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 14 02:11:01 servidor sshd[272678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 14 02:11:03 servidor sshd[272678]: Failed password for invalid user adcolheita from 103.149.28.61 port 60356 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.199.112.65
country_id: 2921044
description:
Jul 14 02:13:47 servidor sshd[273320]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.199.112.65 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.199.112.65
country_id: 2921044
description:
Jul 14 02:13:47 servidor sshd[273320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.199.112.65


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 14 02:14:58 servidor sshd[273497]: Failed password for redecast from 92.118.39.115 port 54008 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.79.180.221
country_id: 2635167
description:
Jul 14 02:14:27 servidor sshd[273452]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.79.180.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.79.180.221
country_id: 2635167
description:
Jul 14 02:14:27 servidor sshd[273452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.79.180.221


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 14 02:14:56 servidor sshd[273497]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 14 02:14:56 servidor sshd[273497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.115  user=redecast


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.67.107.106
country_id: 2510769
description:
2025-07-14 02:16:37 dovecot_login authenticator failed for ([185.67.107.106]) [185.67.107.106]:44528: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-07-14 02:16:48 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:49630: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 14 02:17:30 servidor sshd[275944]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 14 02:17:30 servidor sshd[275944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.177.116
country_id: 6252001
description:
Jul 14 02:18:22 servidor sshd[276117]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.177.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.177.116
country_id: 6252001
description:
Jul 14 02:18:22 servidor sshd[276117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.177.116  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
country_id: 1835841
description:
Jul 14 02:20:02 servidor sshd[276335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
country_id: 1835841
description:
Jul 14 02:20:02 servidor sshd[276335]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 02:21:47 servidor sshd[276984]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 02:21:47 servidor sshd[276984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 14 02:27:38 servidor sshd[278342]: Failed password for mumbacafm from 92.118.39.81 port 41522 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 14 02:27:36 servidor sshd[278342]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 14 02:27:36 servidor sshd[278342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.81  user=mumbacafm


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.184.25.213
country_id: 1210997
description:
2025-07-14 02:29:49 dovecot_login authenticator failed for ([103.184.25.213]) [103.184.25.213]:56921: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 14 02:29:54 servidor sshd[278998]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 14 02:29:54 servidor sshd[278998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.115


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.252.90.190
country_id: 3017382
description:
Jul 14 02:29:26 servidor sshd[278925]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.252.90.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.252.90.190
country_id: 3017382
description:
Jul 14 02:29:26 servidor sshd[278925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.252.90.190


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
country_id: 3144096
description:
2025-07-14 02:29:33 dovecot_login authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:43504: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.164.199.128
country_id: 6252001
description:
Jul 14 02:30:27 servidor sshd[280100]: pam_imunify(sshd:auth): [IM360_RBL] The IP 76.164.199.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 76.164.199.128
country_id: 6252001
description:
Jul 14 02:30:27 servidor sshd[280100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.164.199.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-14 02:31:23 -0300] info [cpaneld] 185.243.96.5 - Jeffrey "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Jeffrey (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.132.58.31
country_id: 3017382
description:
Jul 14 02:33:51 servidor sshd[281655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.132.58.31 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.132.58.31
country_id: 3017382
description:
Jul 14 02:33:51 servidor sshd[281655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.58.31


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.83.190
country_id: 1861060
description:
Jul 14 02:34:36 servidor sshd[281788]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.95.83.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.95.83.190
country_id: 1861060
description:
Jul 14 02:34:36 servidor sshd[281788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.83.190  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 14 02:35:03 servidor sshd[282023]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 14 02:35:03 servidor sshd[282023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.228.250.10
country_id: 3895114
description:
Jul 14 02:35:57 servidor sshd[282213]: pam_imunify(sshd:auth): [IM360_RBL] The IP 168.228.250.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 168.228.250.10
country_id: 3895114
description:
Jul 14 02:35:57 servidor sshd[282213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.228.250.10


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.222.227
country_id: 1269750
description:
Jul 14 02:38:35 servidor sshd[282836]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.222.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.222.227
country_id: 1269750
description:
Jul 14 02:38:35 servidor sshd[282836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.222.227  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2025-07-14 02:39:26 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:42360: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 88.142.46.185
country_id: 3017382
description:
Jul 14 02:39:32 servidor sshd[283101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.142.46.185  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.55.179
country_id: 2921044
description:
Jul 14 02:39:34 servidor sshd[283105]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.55.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2025-07-14 02:39:48 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:47580: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.142.46.185
country_id: 3017382
description:
Jul 14 02:39:32 servidor sshd[283101]: pam_imunify(sshd:auth): [IM360_RBL] The IP 88.142.46.185 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.55.179
country_id: 2921044
description:
Jul 14 02:39:34 servidor sshd[283105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.55.179  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 14 02:39:53 servidor sshd[283163]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 14 02:39:53 servidor sshd[283163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.131.233
country_id: 6252001
description:
Jul 14 02:40:16 servidor sshd[283390]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.217.131.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.217.131.233
country_id: 6252001
description:
Jul 14 02:40:16 servidor sshd[283390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.217.131.233  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 206.217.131.233
country_id: 6252001
description:
Jul 14 02:40:18 servidor sshd[283390]: Failed password for root from 206.217.131.233 port 50432 ssh2


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 14 02:41:54 servidor sshd[283678]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 206.217.131.233
country_id: 6252001
description:
Jul 14 02:41:26 servidor sshd[283572]: Failed password for root from 206.217.131.233 port 50256 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 88.142.46.185
country_id: 3017382
description:
Jul 14 02:41:08 servidor sshd[283548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.142.46.185  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.222.227
country_id: 1269750
description:
Jul 14 02:41:11 servidor sshd[283557]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.222.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.131.233
country_id: 6252001
description:
Jul 14 02:41:24 servidor sshd[283572]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.217.131.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.217.131.233
country_id: 6252001
description:
Jul 14 02:41:24 servidor sshd[283572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.217.131.233  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.142.46.185
country_id: 3017382
description:
Jul 14 02:41:08 servidor sshd[283548]: pam_imunify(sshd:auth): [IM360_RBL] The IP 88.142.46.185 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.222.227
country_id: 1269750
description:
Jul 14 02:41:11 servidor sshd[283557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.222.227  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 14 02:42:09 servidor sshd[283892]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=redestreamhost


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.142.46.185
country_id: 3017382
description:
Jul 14 02:42:12 servidor sshd[283906]: pam_imunify(sshd:auth): [IM360_RBL] The IP 88.142.46.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.131.233
country_id: 6252001
description:
Jul 14 02:42:29 servidor sshd[284013]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.217.131.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.217.131.233
country_id: 6252001
description:
Jul 14 02:42:29 servidor sshd[284013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.217.131.233  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 206.217.131.233
country_id: 6252001
description:
Jul 14 02:42:31 servidor sshd[284013]: Failed password for root from 206.217.131.233 port 49820 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 14 02:42:09 servidor sshd[283890]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.222.227
country_id: 1269750
description:
Jul 14 02:42:29 servidor sshd[283962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.222.227  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.214.6.212
country_id: 2750405
description:
Jul 14 02:43:00 servidor sshd[284157]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.214.6.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.214.6.212
country_id: 2750405
description:
Jul 14 02:43:00 servidor sshd[284157]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.214.6.212


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 88.142.46.185
country_id: 3017382
description:
Jul 14 02:42:12 servidor sshd[283906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.142.46.185  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.222.227
country_id: 1269750
description:
Jul 14 02:42:29 servidor sshd[283962]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.222.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.136.5.57
country_id: 298795
description:
2025-07-14 02:43:35 H=([45.136.5.57]) [45.136.5.57]:64045 F=<support@gsta.com> rejected RCPT <Testertester1@online.no>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.214.6.212
country_id: 2750405
description:
Jul 14 02:43:02 servidor sshd[284157]: Failed password for invalid user adcolheita from 103.214.6.212 port 43946 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.72.162.225
country_id: 1861060
description:
2025-07-14 02:48:38 dovecot_plain authenticator failed for m106072162225.v4.enabler.ne.jp ([191.96.207.20]) [106.72.162.225]:64535: 535 Incorrect authentication data (set_id=admin@servidor.redestreamhost.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.48.80.9
country_id: 1269750
description:
[2025-07-14 02:48:10 -0300] info [cpaneld] 157.48.80.9 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.27.244
country_id: 1269750
description:
2025-07-14 02:48:13 dovecot_plain authenticator failed for ([191.96.207.20]) [122.179.27.244]:44537: 535 Incorrect authentication data (set_id=info@servidor.redestreamhost.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.138.66.150
country_id: 3865483
description:
[2025-07-14 02:48:20 -0300] info [cpaneld] 190.138.66.150 - servidorredestreamhostcombr "GET /login/?login_only=1&user=servidorredestreamhostcombr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user servidorredestreamhostcombr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.208.42.186
country_id: 3469034
description:
2025-07-14 02:48:20 dovecot_plain authenticator failed for 143-208-42-186.users.certto.com.br ([191.96.207.20]) [143.208.42.186]:47213: 535 Incorrect authentication data (set_id=info@servidor.redestreamhost.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.17.192.199
country_id: 2017370
description:
[2025-07-14 02:48:23 -0300] info [cpaneld] 188.17.192.199 - servidor "GET /login/?login_only=1&user=servidor&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user servidor (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.241.37.200
country_id: 248816
description:
[2025-07-14 02:48:31 -0300] info [cpaneld] 92.241.37.200 - servid "GET /login/?login_only=1&user=servid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user servid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.235.234.236
country_id: 1562822
description:
2025-07-14 02:49:09 dovecot_plain authenticator failed for ([191.96.207.20]) [125.235.234.236]:1256: 535 Incorrect authentication data (set_id=support@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.132.150.66
country_id: 298795
description:
2025-07-14 02:49:24 dovecot_plain authenticator failed for ([191.96.207.20]) [188.132.150.66]:59531: 535 Incorrect authentication data (set_id=support@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.253.247.9
country_id: 1269750
description:
2025-07-14 02:49:36 dovecot_plain authenticator failed for ([191.96.207.20]) [124.253.247.9]:35169: 535 Incorrect authentication data (set_id=support@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.47.224.174
country_id: 3175395
description:
2025-07-14 02:49:58 dovecot_plain authenticator failed for ([191.96.207.20]) [158.47.224.174]:25263: 535 Incorrect authentication data (set_id=sales@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.47.224.174
country_id: 3175395
description:
2025-07-14 02:50:05 dovecot_login authenticator failed for ([191.96.207.20]) [158.47.224.174]:25263: 535 Incorrect authentication data (set_id=sales@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.91.250.37
country_id: 3932488
description:
2025-07-14 02:50:19 dovecot_plain authenticator failed for ([191.96.207.20]) [177.91.250.37]:56649: 535 Incorrect authentication data (set_id=marketing@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-07-14 02:50:37 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:35352: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.185.199.193
country_id: 2017370
description:
2025-07-14 02:50:49 dovecot_plain authenticator failed for ([191.96.207.20]) [93.185.199.193]:4517: 535 Incorrect authentication data (set_id=contact@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.0.108
country_id: 1835841
description:
2025-07-14 02:50:51 dovecot_login authenticator failed for ([119.207.0.108]) [119.207.0.108]:35502: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.101.42
country_id: 1269750
description:
2025-07-14 02:51:09 dovecot_plain authenticator failed for ([191.96.207.20]) [49.37.101.42]:57597: 535 Incorrect authentication data (set_id=contato@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.46.194.105
country_id: 1168579
description:
2025-07-14 02:51:20 dovecot_plain authenticator failed for ([191.96.207.20]) [39.46.194.105]:51690: 535 Incorrect authentication data (set_id=contacto@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.150.70.2
country_id: 1269750
description:
2025-07-14 02:51:32 dovecot_plain authenticator failed for ([191.96.207.20]) [103.150.70.2]:40948: 535 Incorrect authentication data (set_id=contacto@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.236.199.78
country_id: 3469034
description:
2025-07-14 02:51:53 dovecot_plain authenticator failed for ([191.96.207.20]) [45.236.199.78]:22891: 535 Incorrect authentication data (set_id=financeiro@servidor.redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.51.43.63
country_id: 1814991
description:
Jul 14 02:52:43 servidor sshd[288483]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.51.43.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.51.43.63
country_id: 1814991
description:
Jul 14 02:52:43 servidor sshd[288483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.51.43.63


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.219.95
country_id: 1269750
description:
2025-07-14 02:52:55 dovecot_plain authenticator failed for ([191.96.207.20]) [49.36.219.95]:44448: 535 Incorrect authentication data (set_id=webmaster@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.148.137.253
country_id: 1694008
description:
2025-07-14 02:52:05 dovecot_plain authenticator failed for ([191.96.207.20]) [49.148.137.253]:53899: 535 Incorrect authentication data (set_id=financeiro@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.221.6
country_id: 192950
description:
2025-07-14 02:52:30 dovecot_plain authenticator failed for ([191.96.207.20]) [102.210.221.6]:55277: 535 Incorrect authentication data (set_id=comercial@servidor.redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.120.124
country_id: 1814991
description:
Jul 14 02:53:11 servidor sshd[288593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.120.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.12.158
country_id: 3469034
description:
2025-07-14 02:53:21 dovecot_plain authenticator failed for ([191.96.207.20]) [179.48.12.158]:50555: 535 Incorrect authentication data (set_id=it@servidor.redestreamhost.com.br)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.112.127.104
country_id: 2750405
description:
Jul 14 02:54:01 servidor sshd[288727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.112.127.104  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.253.223.5
country_id: 3469034
description:
2025-07-14 02:53:30 dovecot_plain authenticator failed for ([191.96.207.20]) [191.253.223.5]:34895: 535 Incorrect authentication data (set_id=it@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.14.156.146
country_id: 1269750
description:
2025-07-14 02:53:44 dovecot_plain authenticator failed for ([191.96.207.20]) [49.14.156.146]:42525: 535 Incorrect authentication data (set_id=it@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.195.202.167
country_id: 1269750
description:
2025-07-14 02:53:56 dovecot_plain authenticator failed for ([191.96.207.20]) [103.195.202.167]:48579: 535 Incorrect authentication data (set_id=accounts@servidor.redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.185
country_id: 732800
description:
Jul 14 02:53:04 servidor sshd[288567]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.185 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.185
country_id: 732800
description:
Jul 14 02:53:04 servidor sshd[288567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.185


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.120.124
country_id: 1814991
description:
Jul 14 02:53:11 servidor sshd[288593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.120.124


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.127.104
country_id: 2750405
description:
Jul 14 02:54:01 servidor sshd[288727]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.112.127.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.100.254.137
country_id: 3469034
description:
2025-07-14 02:54:22 dovecot_plain authenticator failed for ([191.96.207.20]) [189.100.254.137]:59359: 535 Incorrect authentication data (set_id=noreply@servidor.redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
country_id: 1835841
description:
Jul 14 02:54:42 servidor sshd[288915]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
country_id: 1835841
description:
Jul 14 02:54:42 servidor sshd[288915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 221.156.137.103
country_id: 1835841
description:
Jul 14 02:54:44 servidor sshd[288915]: Failed password for root from 221.156.137.103 port 38558 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.108.47.50
country_id: 6290252
description:
2025-07-14 02:54:44 dovecot_plain authenticator failed for ([191.96.207.20]) [176.108.47.50]:41677: 535 Incorrect authentication data (set_id=suporte@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.6.179.168
country_id: 1694008
description:
2025-07-14 02:55:00 dovecot_plain authenticator failed for ([191.96.207.20]) [124.6.179.168]:58997: 535 Incorrect authentication data (set_id=suporte@servidor.redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 02:55:53 servidor sshd[289282]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 02:55:54 servidor sshd[289282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.6.179.168
country_id: 1694008
description:
2025-07-14 02:55:07 dovecot_login authenticator failed for ([191.96.207.20]) [124.6.179.168]:58997: 535 Incorrect authentication data (set_id=suporte@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.178.194.77
country_id: 1269750
description:
2025-07-14 02:55:27 dovecot_plain authenticator failed for ([191.96.207.20]) [59.178.194.77]:46187: 535 Incorrect authentication data (set_id=hr@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.49.150.224
country_id: 1269750
description:
2025-07-14 02:55:39 dovecot_plain authenticator failed for ([191.96.207.20]) [157.49.150.224]:38703: 535 Incorrect authentication data (set_id=ceo@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.217.157.193
country_id: 1327865
description:
2025-07-14 02:55:50 dovecot_plain authenticator failed for ([191.96.207.20]) [103.217.157.193]:4010: 535 Incorrect authentication data (set_id=ceo@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.27.235.191
country_id: 3686110
description:
2025-07-14 02:57:02 dovecot_plain authenticator failed for dsl-emcali-186.27.235.191.emcali.net.co ([191.96.207.20]) [186.27.235.191]:42640: 535 Incorrect authentication data (set_id=soporte@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.155.95
country_id: 1269750
description:
2025-07-14 02:56:11 dovecot_plain authenticator failed for ([191.96.207.20]) [103.181.155.95]:2355: 535 Incorrect authentication data (set_id=office@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.218.101
country_id: 1269750
description:
2025-07-14 02:56:25 dovecot_plain authenticator failed for ([191.96.207.20]) [49.43.218.101]:44973: 535 Incorrect authentication data (set_id=office@servidor.redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.222.182.44
country_id: 3932488
description:
2025-07-14 02:56:50 dovecot_plain authenticator failed for ([191.96.207.20]) [129.222.182.44]:54692: 535 Incorrect authentication data (set_id=soporte@servidor.redestreamhost.com.br)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 14 02:57:30 servidor sshd[289621]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.123.231
country_id: 1835841
description:
Jul 14 02:58:06 servidor sshd[289902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.123.231  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 175.126.123.231
country_id: 1835841
description:
Jul 14 02:58:08 servidor sshd[289902]: Failed password for redestreamhost from 175.126.123.231 port 48532 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Jul 14 02:58:06 servidor sshd[289902]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.120.124
country_id: 1814991
description:
Jul 14 02:59:38 servidor sshd[290140]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.120.124 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.120.124
country_id: 1814991
description:
Jul 14 02:59:38 servidor sshd[290140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.120.124


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.149.146.202
country_id: 2921044
description:
Jul 14 03:00:54 servidor sshd[292417]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.149.146.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.149.146.202
country_id: 2921044
description:
Jul 14 03:00:54 servidor sshd[292417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.149.146.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.110.161.134
country_id: 1814991
description:
2025-07-14 03:00:58 dovecot_login authenticator failed for ([36.110.161.134]) [36.110.161.134]:40141: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.165.200
country_id: 6252001
description:
Jul 14 03:01:07 servidor dovecot[145610]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.165.200, lip=69.30.198.26, session=<jUy7Yt058JRHBqXI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.212.92
country_id: 2017370
description:
2025-07-14 03:01:12 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:58246: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-14 03:01:15 -0300] info [cpaneld] 185.243.96.5 - Kyle "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Kyle (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 14 03:01:48 servidor sshd[292602]: pam_imunify(sshd:auth): [IM360_RBL] The IP 1.226.84.145 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 14 03:01:48 servidor sshd[292602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.226.84.145  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.185
country_id: 732800
description:
Jul 14 03:02:39 servidor sshd[292859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.185


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.185
country_id: 732800
description:
Jul 14 03:02:39 servidor sshd[292859]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.51.43.63
country_id: 1814991
description:
Jul 14 03:03:14 servidor sshd[293013]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.51.43.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.51.43.63
country_id: 1814991
description:
Jul 14 03:03:14 servidor sshd[293013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.51.43.63


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 14 03:03:15 servidor sshd[293020]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 14 03:03:15 servidor sshd[293020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 14 03:07:05 servidor sshd[293994]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 14 03:07:05 servidor sshd[293994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.208.253.140
country_id: 130758
description:
Jul 14 03:07:23 servidor sshd[294034]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.208.253.140 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.208.253.140
country_id: 130758
description:
Jul 14 03:07:23 servidor sshd[294034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.208.253.140


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.208.253.140
country_id: 130758
description:
Jul 14 03:08:46 servidor sshd[294447]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.208.253.140 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.208.253.140
country_id: 130758
description:
Jul 14 03:08:46 servidor sshd[294447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.208.253.140


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.208.253.140
country_id: 130758
description:
Jul 14 03:10:02 servidor sshd[294853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.208.253.140


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.51.43.63
country_id: 1814991
description:
Jul 14 03:10:00 servidor sshd[294770]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.51.43.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.120.124
country_id: 1814991
description:
Jul 14 03:09:35 servidor sshd[294627]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.120.124


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.51.43.63
country_id: 1814991
description:
Jul 14 03:10:00 servidor sshd[294770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.51.43.63


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.208.253.140
country_id: 130758
description:
Jul 14 03:10:02 servidor sshd[294853]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.208.253.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.120.124
country_id: 1814991
description:
Jul 14 03:09:35 servidor sshd[294627]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.120.124 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.140
country_id: 130758
description:
Jul 14 03:10:04 servidor sshd[294853]: Failed password for invalid user vps from 85.208.253.140 port 35336 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.185
country_id: 732800
description:
Jul 14 03:12:11 servidor sshd[295430]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.185 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.185
country_id: 732800
description:
Jul 14 03:12:11 servidor sshd[295430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.185


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.4.70.205
country_id: 690791
description:
Jul 14 03:12:27 servidor sshd[295481]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.4.70.205 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.4.70.205
country_id: 690791
description:
Jul 14 03:12:27 servidor sshd[295481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.4.70.205  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.128.112.74
country_id: 732800
description:
Jul 14 03:13:30 servidor sshd[295830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.128.112.74


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.220.91
country_id: 2017370
description:
2025-07-14 03:14:51 dovecot_login authenticator failed for (91-220-216-178.omsk.mts.ru) [178.216.220.91]:53768: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.8.106
country_id: 1814991
description:
2025-07-14 03:15:15 dovecot_login authenticator failed for ([58.16.8.106]) [58.16.8.106]:58372: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.72.149
country_id: 1814991
description:
Jul 14 03:18:45 servidor sshd[298838]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.26.72.149 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.26.72.149
country_id: 1814991
description:
Jul 14 03:18:45 servidor sshd[298838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.26.72.149  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.118.166
country_id: 1814991
description:
Jul 14 03:18:02 servidor sshd[298509]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.118.166
country_id: 1814991
description:
Jul 14 03:18:02 servidor sshd[298509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.118.166  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.247.24.89
country_id: 1835841
description:
Jul 14 03:22:15 servidor sshd[299706]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.247.24.89 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.247.24.89
country_id: 1835841
description:
Jul 14 03:22:15 servidor sshd[299706]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.24.89


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.173.248.12
country_id: 2750405
description:
Jul 14 03:23:12 servidor sshd[299954]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.173.248.12 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.173.248.12
country_id: 2750405
description:
Jul 14 03:23:12 servidor sshd[299954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.173.248.12  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.72.149
country_id: 1814991
description:
Jul 14 03:23:12 servidor sshd[299952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.26.72.149 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.26.72.149
country_id: 1814991
description:
Jul 14 03:23:12 servidor sshd[299952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.26.72.149  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.72.149
country_id: 1814991
description:
Jul 14 03:24:33 servidor sshd[300328]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.26.72.149 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.26.72.149
country_id: 1814991
description:
Jul 14 03:24:33 servidor sshd[300328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.26.72.149  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.220.124.69
country_id: 2921044
description:
Jul 14 03:24:49 servidor sshd[300391]: pam_imunify(sshd:auth): [IM360_RBL] The IP 158.220.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 158.220.124.69
country_id: 2921044
description:
Jul 14 03:24:49 servidor sshd[300391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.220.124.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.65.253.31
country_id: 1562822
description:
2025-07-14 03:26:22 dovecot_login authenticator failed for ([27.65.253.31]) [27.65.253.31]:45752: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-07-14 03:26:36 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:33124: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 03:29:42 servidor sshd[301623]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 03:29:42 servidor sshd[301623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
country_id: 1269750
description:
Jul 14 03:29:53 servidor sshd[301646]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
country_id: 1269750
description:
Jul 14 03:29:53 servidor sshd[301646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.115.125
country_id: 6252001
description:
Jul 14 03:30:04 servidor sshd[301813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.115.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
country_id: 6252001
description:
Jul 14 03:30:04 servidor sshd[301813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 157.245.115.125
country_id: 6252001
description:
Jul 14 03:30:06 servidor sshd[301813]: Failed password for root from 157.245.115.125 port 52494 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.118.166
country_id: 1814991
description:
Jul 14 03:30:41 servidor sshd[303644]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.118.166
country_id: 1814991
description:
Jul 14 03:30:41 servidor sshd[303644]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.118.166  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-14 03:31:20 -0300] info [cpaneld] 185.243.96.5 - Samuel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Samuel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-07-14 03:34:01 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:41178: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.134.22.66
country_id: 1880251
description:
Jul 14 03:34:49 servidor sshd[304527]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.134.22.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.134.22.66
country_id: 1880251
description:
Jul 14 03:34:49 servidor sshd[304527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.134.22.66


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
country_id: 1880251
description:
2025-07-14 03:34:15 dovecot_login authenticator failed for (80-184-100-101.myrepublic.com.sg) [218.212.153.73]:47018: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.142.143.51
country_id: 298795
description:
Jul 14 03:36:18 servidor sshd[305194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 213.142.143.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 213.142.143.51
country_id: 298795
description:
Jul 14 03:36:18 servidor sshd[305194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.142.143.51


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 14 03:41:33 servidor sshd[306739]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 14 03:41:05 servidor sshd[306407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.81


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 14 03:41:12 servidor sshd[306436]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 14 03:41:12 servidor sshd[306436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 14 03:41:05 servidor sshd[306407]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.118.166
country_id: 1814991
description:
Jul 14 03:42:31 servidor sshd[306928]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.118.166
country_id: 1814991
description:
Jul 14 03:42:31 servidor sshd[306928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.118.166  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.206.75
country_id: 6252001
description:
Jul 14 03:43:59 servidor sshd[307272]: pam_imunify(sshd:auth): [IM360_RBL] The IP 147.182.206.75 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 147.182.206.75
country_id: 6252001
description:
Jul 14 03:43:59 servidor sshd[307272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.182.206.75  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.122.238
country_id: 2921044
description:
Jul 14 03:52:12 servidor sshd[311129]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.122.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.122.238
country_id: 2921044
description:
Jul 14 03:52:12 servidor sshd[311129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.122.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.67.107.106
country_id: 2510769
description:
2025-07-14 03:53:01 dovecot_login authenticator failed for ([185.67.107.106]) [185.67.107.106]:53758: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 14 03:53:58 servidor sshd[311683]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.34.38
country_id: 1269750
description:
2025-07-14 03:53:21 dovecot_login authenticator failed for ([1.7.229.162]) [49.37.34.38]:33504: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.222.24
country_id: 3017382
description:
Jul 14 03:53:33 servidor sshd[311374]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.77.222.24 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.77.222.24
country_id: 3017382
description:
Jul 14 03:53:33 servidor sshd[311374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.222.24  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 14 03:55:41 servidor sshd[312209]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 14 03:55:41 servidor sshd[312209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.212.103.171
country_id: 798549
description:
Jul 14 03:57:37 servidor sshd[312646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.212.103.171


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.212.103.171
country_id: 798549
description:
Jul 14 03:57:37 servidor sshd[312646]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.212.103.171 has been locked due to Imunify RBL


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 103.172.236.164
country_id: 1562822
description:
Jul 14 03:58:24 servidor sshd[312891]: Failed password for root from 103.172.236.164 port 60644 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.236.164
country_id: 1562822
description:
Jul 14 03:58:22 servidor sshd[312891]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.172.236.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.172.236.164
country_id: 1562822
description:
Jul 14 03:58:22 servidor sshd[312891]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.172.236.164  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 14 04:00:35 servidor sshd[315543]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.130.113.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 14 04:00:35 servidor sshd[315543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.130.113.204  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 14 04:00:37 servidor sshd[315543]: Failed password for root from 125.130.113.204 port 49246 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-14 04:01:22 -0300] info [cpaneld] 185.243.96.5 - Jeremy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Jeremy (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.92.103
country_id: 798549
description:
Jul 14 04:03:47 servidor sshd[316879]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.94.92.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.103
country_id: 798549
description:
Jul 14 04:03:47 servidor sshd[316879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.103


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.176.84.4
country_id: 6252001
description:
Jul 14 04:03:09 servidor sshd[316769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.176.84.4


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 04:03:32 servidor sshd[316835]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 14 04:03:32 servidor sshd[316835]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.231.110.214
country_id: 6252001
description:
Jul 14 04:04:17 servidor sshd[317014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.231.110.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.126.71.192
country_id: 2921044
description:
2025-07-14 04:04:22 dovecot_login authenticator failed for 192-071-126-176.ip-addr.vsenet.de [176.126.71.192]:43870: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.37.11
country_id: 1814991
description:
2025-07-14 04:04:36 dovecot_login authenticator failed for ([60.216.37.11]) [60.216.37.11]:43818: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.114.45.37
country_id: 2921044
description:
Jul 14 04:04:42 servidor sshd[317055]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.114.45.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.114.45.37
country_id: 2921044
description:
Jul 14 04:04:42 servidor sshd[317055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.114.45.37  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.231.110.214
country_id: 6252001
description:
Jul 14 04:04:17 servidor sshd[317014]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.231.110.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 14 04:06:17 servidor sshd[317531]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 14 04:06:17 servidor sshd[317531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.246.224.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 14 04:06:30 servidor sshd[317558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.191.175.4
country_id: 1562822
description:
Jul 14 04:06:33 servidor sshd[317565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.191.175.4  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 14 04:06:19 servidor sshd[317531]: Failed password for root from 106.246.224.218 port 59826 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 14 04:06:30 servidor sshd[317558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.175.4
country_id: 1562822
description:
Jul 14 04:06:33 servidor sshd[317565]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.191.175.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.30.45.112
country_id: 1562822
description:
Jul 14 04:09:47 servidor sshd[318390]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.30.45.112 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.30.45.112
country_id: 1562822
description:
Jul 14 04:09:47 servidor sshd[318390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.30.45.112  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.92.103
country_id: 798549
description:
Jul 14 04:11:41 servidor sshd[318933]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.94.92.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.103
country_id: 798549
description:
Jul 14 04:11:41 servidor sshd[318933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.103


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.66.63.187
country_id: 1835841
description:
2025-07-14 04:13:08 dovecot_login authenticator failed for ([121.66.63.187]) [121.66.63.187]:59684: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 14 04:15:43 servidor sshd[322226]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 14 04:15:43 servidor sshd[322226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 14 04:15:45 servidor sshd[322226]: Failed password for redestreamhost from 92.118.39.34 port 56188 ssh2


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jul 14 04:17:02 servidor kernel: update_componen[322480]: segfault at 7f817a2c8288 ip 00007f857cebc8a0 sp 00007ffd853df9e8 error 4 in libpython3.11.so.1.0[7f857cdd4000+2a3000]


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.94.92.103
country_id: 798549
description:
Jul 14 04:19:24 servidor sshd[323228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.94.92.103


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.94.92.103
country_id: 798549
description:
Jul 14 04:19:24 servidor sshd[323228]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.94.92.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.164
country_id: 6252001
description:
Jul 14 04:20:48 servidor sshd[323672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.164


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.87.128
country_id: 2921044
description:
Jul 14 04:21:10 servidor sshd[323760]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.87.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.87.128
country_id: 2921044
description:
Jul 14 04:21:10 servidor sshd[323760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.87.128  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 14 04:22:10 servidor sshd[323971]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.98.0
country_id: 1880251
description:
Jul 14 04:23:53 servidor sshd[324444]: pam_imunify(sshd:auth): [IM360_RBL] The IP 134.209.98.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 134.209.98.0
country_id: 1880251
description:
Jul 14 04:23:53 servidor sshd[324444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.98.0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.32.41.79
country_id: 2635167
description:
[2025-07-14 04:24:47 -0300] info [whostmgrd] 84.32.41.79 - - "POST /json-api/create_user_session HTTP/1.1" FAILED LOGIN whostmgrd: user name not provided or invalid user


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 14 04:24:30 servidor sshd[324804]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.131.12.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 14 04:24:30 servidor sshd[324804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.131.12.238  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.52.178.15
country_id: 6252001
description:
Jul 14 04:26:48 servidor sshd[325344]: pam_imunify(sshd:auth): [IM360_RBL] The IP 72.52.178.15 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 72.52.178.15
country_id: 6252001
description:
Jul 14 04:26:48 servidor sshd[325344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.52.178.15  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.108.192
country_id: 3017382
description:
Jul 14 04:27:14 servidor sshd[325436]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.108.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.108.192
country_id: 3017382
description:
Jul 14 04:27:14 servidor sshd[325436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.108.192  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.53.253.2
country_id: 1814991
description:
Jul 14 04:28:41 servidor sshd[325708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.53.253.2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.53.253.2
country_id: 1814991
description:
Jul 14 04:28:41 servidor sshd[325708]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.53.253.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-07-14 04:29:39 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:60672: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-07-14 04:30:05 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:40594: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.77.153.34
country_id: 3017382
description:
Jul 14 04:31:54 servidor sshd[328286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.153.34  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-14 04:31:15 -0300] info [cpaneld] 185.243.96.5 - Jose "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Jose (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.153.34
country_id: 3017382
description:
Jul 14 04:31:54 servidor sshd[328286]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.77.153.34 has been locked due to Imunify RBL


