# incident

plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:03:49 servidor sshd[159919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.135.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:03:49 servidor sshd[159919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.135.20  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:04:29 servidor sshd[160826]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.198.146.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:04:29 servidor sshd[160826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.146.227  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:05:41 servidor sshd[161851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.146.227  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:05:03 servidor sshd[161490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.137.249.148  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:05:04 servidor sshd[161661]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.135.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:05:11 servidor sshd[161691]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.82.90.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:05:15 servidor sshd[161702]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.217.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:05:11 servidor sshd[161691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.82.90.210  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:05:15 servidor sshd[161702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.217.28  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:05:41 servidor sshd[161851]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.198.146.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:05:03 servidor sshd[161490]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.137.249.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:05:04 servidor sshd[161661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.135.20  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:06:12 servidor sshd[162799]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.135.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:06:12 servidor sshd[162799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.135.20  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:06:26 servidor sshd[163084]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.82.90.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 11:06:21 servidor sshd[163051]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
country_id: 2750405
description:
Jul 13 11:06:21 servidor sshd[163051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:06:26 servidor sshd[163084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.82.90.210  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.52.21.96
country_id: 6251999
description:
Jul 13 11:06:36 servidor sshd[163101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.52.21.96


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.52.21.96
country_id: 6251999
description:
Jul 13 11:06:36 servidor sshd[163101]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.52.21.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:06:40 servidor sshd[163143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.217.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:06:40 servidor sshd[163143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.217.28  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:07:22 servidor sshd[163352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.135.20  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:07:41 servidor sshd[163421]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.82.90.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:06:54 servidor sshd[163189]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.198.146.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:06:54 servidor sshd[163189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.146.227  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.247.24.89
country_id: 1835841
description:
Jul 13 11:06:58 servidor sshd[163256]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.247.24.89 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.247.24.89
country_id: 1835841
description:
Jul 13 11:06:58 servidor sshd[163256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.24.89  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:07:14 servidor sshd[163329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.137.249.148  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:07:14 servidor sshd[163329]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.137.249.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.82.90.210
country_id: 2017370
description:
Jul 13 11:07:41 servidor sshd[163421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.82.90.210  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.135.20
country_id: 6252001
description:
Jul 13 11:07:22 servidor sshd[163352]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.135.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:08:02 servidor sshd[163649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.217.28  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:08:15 servidor sshd[163849]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.198.146.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.198.146.227
country_id: 2921044
description:
Jul 13 11:08:15 servidor sshd[163849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.146.227  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.217.28
country_id: 1835841
description:
Jul 13 11:08:02 servidor sshd[163649]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.217.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 196.251.84.225
country_id: 2750405
description:
Jul 13 11:08:59 servidor sshd[164097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.251.84.225


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 11:09:36 -0300] info [cpaneld] 185.243.96.5 - James "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user James (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:09:38 servidor sshd[164264]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.137.249.148 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.137.249.148
country_id: 1814991
description:
Jul 13 11:09:38 servidor sshd[164264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.137.249.148  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.84.225
country_id: 2750405
description:
Jul 13 11:08:59 servidor sshd[164097]: pam_imunify(sshd:auth): [IM360_RBL] The IP 196.251.84.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 11:10:22 servidor sshd[164639]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 11:10:22 servidor sshd[164639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.83.190
country_id: 1861060
description:
Jul 13 11:10:58 servidor sshd[164686]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.95.83.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.95.83.190
country_id: 1861060
description:
Jul 13 11:10:58 servidor sshd[164686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.83.190  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.236.164
country_id: 1562822
description:
Jul 13 11:12:02 servidor sshd[165041]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.172.236.164 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.172.236.164
country_id: 1562822
description:
Jul 13 11:12:02 servidor sshd[165041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.172.236.164


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 168.228.250.10
country_id: 3895114
description:
Jul 13 11:12:42 servidor sshd[165127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.228.250.10  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.134.22.66
country_id: 1880251
description:
Jul 13 11:14:35 servidor sshd[165505]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.134.22.66 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.134.22.66
country_id: 1880251
description:
Jul 13 11:14:35 servidor sshd[165505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.134.22.66


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 11:14:02 servidor sshd[165421]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 11:14:02 servidor sshd[165421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.81


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 11:17:16 servidor sshd[167016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.226.84.145  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:28 servidor sshd[167052]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.120.189.255 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:28 servidor sshd[167052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.120.189.255  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:30 servidor sshd[167052]: Failed password for root from 181.120.189.255 port 51572 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 11:17:16 servidor sshd[167016]: pam_imunify(sshd:auth): [IM360_RBL] The IP 1.226.84.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:55 servidor sshd[167093]: pam_imunify(sshd:auth): [IM360_RBL] The IP 181.120.189.255 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:55 servidor sshd[167093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.120.189.255  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 181.120.189.255
country_id: 3437598
description:
Jul 13 11:17:56 servidor sshd[167093]: Failed password for root from 181.120.189.255 port 52825 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-07-13 11:18:05 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:35652: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.177.116
country_id: 6252001
description:
Jul 13 11:18:19 servidor sshd[167221]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.177.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.177.116
country_id: 6252001
description:
Jul 13 11:18:19 servidor sshd[167221]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.177.116  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2025-07-13 11:18:24 dovecot_login authenticator failed for ([220.161.52.149]) [220.161.52.149]:58149: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:19:12 servidor sshd[167485]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:19:12 servidor sshd[167485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.60  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.107.214
country_id: 1814991
description:
Jul 13 11:20:15 servidor sshd[167821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.107.214  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.107.214
country_id: 1814991
description:
Jul 13 11:20:15 servidor sshd[167821]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.107.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.83.15.200
country_id: 1819730
description:
Jul 13 11:20:49 servidor sshd[167861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.83.15.200  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:22:31 servidor sshd[168426]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:22:31 servidor sshd[168426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.60  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.83.15.200
country_id: 1819730
description:
Jul 13 11:22:55 servidor sshd[168473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.83.15.200  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:23:51 servidor sshd[168665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.60  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
country_id: 1643084
description:
Jul 13 11:24:01 servidor sshd[168735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 154.83.15.200
country_id: 1819730
description:
Jul 13 11:24:19 servidor sshd[168833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.83.15.200  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.60
country_id: 130758
description:
Jul 13 11:23:51 servidor sshd[168665]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
country_id: 1643084
description:
Jul 13 11:24:01 servidor sshd[168735]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.83.15.200
country_id: 1819730
description:
Jul 13 11:24:19 servidor sshd[168833]: pam_imunify(sshd:auth): [IM360_RBL] The IP 154.83.15.200 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 11:25:43 servidor sshd[169230]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:40 servidor sshd[169917]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:40 servidor sshd[169917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.149.235.152  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:42 servidor sshd[169917]: Failed password for root from 218.149.235.152 port 46640 ssh2


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:50 servidor sshd[169922]: Failed password for invalid user admin from 218.149.235.152 port 57882 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:57 servidor sshd[169944]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.149.235.152
country_id: 1835841
description:
Jul 13 11:28:57 servidor sshd[169944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.149.235.152


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 11:29:27 servidor sshd[170107]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 11:29:27 servidor sshd[170107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.4.70.205
country_id: 690791
description:
Jul 13 11:31:15 servidor sshd[171223]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.4.70.205 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.4.70.205
country_id: 690791
description:
Jul 13 11:31:15 servidor sshd[171223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.4.70.205


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 11:31:36 servidor sshd[171532]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 11:31:36 servidor sshd[171532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 11:31:59 servidor sshd[171585]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.156.209
country_id: 1835841
description:
2025-07-13 11:32:44 dovecot_login authenticator failed for ([119.207.156.209]) [119.207.156.209]:6745: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 11:32:28 servidor sshd[171757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 11:32:28 servidor sshd[171757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.19.246.172
country_id: 1814991
description:
2025-07-13 11:33:04 dovecot_login authenticator failed for ([183.93.198.164]) [58.19.246.172]:42422: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.142.143.51
country_id: 298795
description:
Jul 13 11:34:22 servidor sshd[175234]: pam_imunify(sshd:auth): [IM360_RBL] The IP 213.142.143.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 213.142.143.51
country_id: 298795
description:
Jul 13 11:34:22 servidor sshd[175234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.142.143.51


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.164.199.128
country_id: 6252001
description:
Jul 13 11:35:40 servidor sshd[175853]: pam_imunify(sshd:auth): [IM360_RBL] The IP 76.164.199.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 76.164.199.128
country_id: 6252001
description:
Jul 13 11:35:40 servidor sshd[175853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.164.199.128  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 11:36:23 -0300] info [cpaneld] 185.243.96.5 - John "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user John (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.107.214
country_id: 1814991
description:
Jul 13 11:37:51 servidor sshd[176313]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.107.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.107.214
country_id: 1814991
description:
Jul 13 11:37:51 servidor sshd[176313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.107.214  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.93.89.118
country_id: 130758
description:
Jul 13 11:38:11 servidor sshd[176316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.93.89.118  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.214.244
country_id: 2921044
description:
Jul 13 11:38:18 servidor sshd[176542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.214.244


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.93.89.118
country_id: 130758
description:
Jul 13 11:39:12 servidor sshd[176800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.93.89.118  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.252.90.190
country_id: 3017382
description:
Jul 13 11:41:53 servidor sshd[177635]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.252.90.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.252.90.190
country_id: 3017382
description:
Jul 13 11:41:53 servidor sshd[177635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.252.90.190


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.145.72.84
country_id: 3017382
description:
Jul 13 11:42:17 servidor sshd[177693]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.145.72.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.145.72.84
country_id: 3017382
description:
Jul 13 11:42:17 servidor sshd[177693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.145.72.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.79.180.221
country_id: 2635167
description:
Jul 13 11:43:31 servidor sshd[178083]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.79.180.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.79.180.221
country_id: 2635167
description:
Jul 13 11:43:31 servidor sshd[178083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.79.180.221  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.157
country_id: 798549
description:
Jul 13 11:43:02 servidor sshd[177805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.157  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 11:44:00 servidor sshd[178176]: Invalid user radioitaboraisantos from 193.32.162.218 port 45906


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 11:44:00 servidor sshd[178176]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 11:44:00 servidor sshd[178176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
country_id: 1269750
description:
Jul 13 11:44:10 servidor sshd[178211]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
country_id: 1269750
description:
Jul 13 11:44:10 servidor sshd[178211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 11:45:14 servidor sshd[178532]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 11:45:14 servidor sshd[178532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 11:46:12 servidor sshd[179404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.214.244
country_id: 2921044
description:
Jul 13 11:45:51 servidor sshd[179323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.214.244


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 11:46:12 servidor sshd[179404]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 11:46:57 servidor sshd[179558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 11:46:57 servidor sshd[179558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.246.224.218  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 11:46:59 servidor sshd[179558]: Failed password for root from 106.246.224.218 port 40772 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.190.104
country_id: 6252001
description:
Jul 13 11:48:12 servidor sshd[179875]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.169.190.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.169.190.104
country_id: 6252001
description:
Jul 13 11:48:12 servidor sshd[179875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.190.104


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:48:22 servidor sshd[179834]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.29.145.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:48:22 servidor sshd[179834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.29.145.180  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 11:49:30 servidor sshd[180237]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 11:49:30 servidor sshd[180237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 11:49:32 servidor sshd[180237]: Failed password for redestreamhost from 92.118.39.34 port 36676 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.128.94
country_id: 2750405
description:
Jul 13 11:50:09 servidor sshd[180525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.128.94


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.55.179
country_id: 2921044
description:
Jul 13 11:52:46 servidor sshd[183907]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.55.179 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.55.179
country_id: 2921044
description:
Jul 13 11:52:46 servidor sshd[183907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.55.179  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.149.146.202
country_id: 2921044
description:
Jul 13 11:53:03 servidor sshd[184001]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.149.146.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.214.244
country_id: 2921044
description:
Jul 13 11:53:31 servidor sshd[184086]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.214.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.30.45.112
country_id: 1562822
description:
Jul 13 11:53:46 servidor sshd[184188]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.30.45.112 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.30.45.112
country_id: 1562822
description:
Jul 13 11:53:46 servidor sshd[184188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.30.45.112


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.149.146.202
country_id: 2921044
description:
Jul 13 11:53:03 servidor sshd[184001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.149.146.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
country_id: 6252001
description:
2025-07-13 11:53:03 dovecot_login authenticator failed for visaustralia.com [216.70.104.41]:57652: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
country_id: 1814991
description:
2025-07-13 11:53:17 dovecot_login authenticator failed for ([220.172.203.43]) [220.172.203.43]:35853: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.214.244
country_id: 2921044
description:
Jul 13 11:53:31 servidor sshd[184086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.214.244


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:55:29 servidor sshd[184531]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.29.145.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:55:29 servidor sshd[184531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.29.145.180  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 11:56:26 servidor sshd[184982]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:56:03 servidor sshd[184814]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.29.145.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.29.145.180
country_id: 6252001
description:
Jul 13 11:56:03 servidor sshd[184814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.29.145.180  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.214.6.212
country_id: 2750405
description:
Jul 13 11:57:35 servidor sshd[185180]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.214.6.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.214.6.212
country_id: 2750405
description:
Jul 13 11:57:35 servidor sshd[185180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.214.6.212


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.132.58.31
country_id: 3017382
description:
Jul 13 11:56:51 servidor sshd[185071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.58.31


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.35.174.186
country_id: 2635167
description:
Jul 13 11:57:20 servidor sshd[185144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.174.186


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.128.94
country_id: 2750405
description:
Jul 13 11:57:47 servidor sshd[185241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.128.94


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.132.58.31
country_id: 3017382
description:
Jul 13 11:56:51 servidor sshd[185071]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.132.58.31 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 11:58:39 servidor sshd[185375]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.128.94
country_id: 2750405
description:
Jul 13 11:57:49 servidor sshd[185241]: Failed password for invalid user TestUser from 152.42.128.94 port 50512 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 12:01:12 servidor sshd[186897]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 12:01:12 servidor sshd[186897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.35.174.186
country_id: 2635167
description:
Jul 13 12:03:44 servidor sshd[187293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.174.186


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 12:03:44 -0300] info [cpaneld] 185.243.96.5 - Joshua "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Joshua (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.100
country_id: 6252001
description:
Jul 13 12:04:04 servidor sshd[187434]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.100
country_id: 6252001
description:
Jul 13 12:04:04 servidor sshd[187434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.100


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 12:04:19 servidor sshd[187460]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 12:04:19 servidor sshd[187460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.128.94
country_id: 2750405
description:
Jul 13 12:05:31 servidor sshd[187939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.128.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.129.246.99
country_id: 357994
description:
2025-07-13 12:06:05 dovecot_login authenticator failed for ([82.129.246.99]) [82.129.246.99]:23790: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
country_id: 1814991
description:
2025-07-13 12:06:27 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:37601: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:06:50 servidor sshd[188194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.166.172 has been locked due to Imunify RBL


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:06:52 servidor sshd[188194]: Failed password for root from 175.126.166.172 port 38846 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:07:24 servidor sshd[188567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.55  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:07:24 servidor sshd[188567]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 12:06:50 servidor sshd[188192]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 12:06:50 servidor sshd[188192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:06:50 servidor sshd[188194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.166.172  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:08:44 servidor sshd[188786]: Failed password for root from 107.150.110.167 port 49760 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:08:06 servidor sshd[188709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.49.152.12  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:08:12 servidor sshd[188733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.107.36.246  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:08:41 servidor sshd[188786]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.150.110.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:08:41 servidor sshd[188786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.150.110.167  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:08:06 servidor sshd[188709]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.49.152.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:08:12 servidor sshd[188733]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.107.36.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:08:54 servidor sshd[188864]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.176.184.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:08:54 servidor sshd[188864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.176.184.113


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.35.174.186
country_id: 2635167
description:
Jul 13 12:10:08 servidor sshd[189337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.174.186


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:10:46 servidor sshd[189444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.166.172  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:09:54 servidor sshd[188983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.47.238.57  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:10:40 servidor sshd[189431]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.176.184.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:10:40 servidor sshd[189431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.176.184.113  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:10:46 servidor sshd[189444]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.166.172 has been locked due to Imunify RBL


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:10:47 servidor sshd[189444]: Failed password for root from 175.126.166.172 port 54612 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:09:54 servidor sshd[188983]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.47.238.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:11:30 servidor sshd[189621]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.150.110.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:11:48 servidor sshd[189643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.176.184.113  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:11:16 servidor sshd[189586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.55  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:11:29 servidor sshd[189616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.47.238.57 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:11:09 servidor sshd[189565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.49.152.12  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:11:16 servidor sshd[189586]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:11:30 servidor sshd[189621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.150.110.167  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:11:09 servidor sshd[189565]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.49.152.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.233.89.161
country_id: 1880251
description:
[2025-07-13 12:11:11 -0300] info [whostmgrd] 194.233.89.161 - distakec "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.176.184.113
country_id: 2921044
description:
Jul 13 12:11:48 servidor sshd[189643]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.176.184.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:11:29 servidor sshd[189616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.47.238.57  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:11:32 servidor sshd[189621]: Failed password for root from 107.150.110.167 port 37356 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:12:44 servidor sshd[189924]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.49.152.12 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.49.152.12
country_id: 3469034
description:
Jul 13 12:12:44 servidor sshd[189924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.49.152.12  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:12:14 servidor sshd[189796]: Failed password for root from 175.126.166.172 port 40996 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:12:35 servidor sshd[189880]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:12:13 servidor sshd[189796]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.166.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.166.172
country_id: 1835841
description:
Jul 13 12:12:13 servidor sshd[189796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.166.172  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.55
country_id: 130758
description:
Jul 13 12:12:35 servidor sshd[189880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.55  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:12:56 servidor sshd[189991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.47.238.57 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.47.238.57
country_id: 1512440
description:
Jul 13 12:12:56 servidor sshd[189991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.47.238.57  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:13:39 servidor sshd[190228]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.107.36.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:13:39 servidor sshd[190228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.107.36.246  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:13:01 servidor sshd[190097]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.150.110.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:13:01 servidor sshd[190097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.150.110.167  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 107.150.110.167
country_id: 6252001
description:
Jul 13 12:13:03 servidor sshd[190097]: Failed password for root from 107.150.110.167 port 10326 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:15:38 servidor sshd[191537]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.107.36.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.107.36.246
country_id: 1819730
description:
Jul 13 12:15:38 servidor sshd[191537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.107.36.246  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 12:18:00 servidor sshd[191984]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 12:18:00 servidor sshd[191984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
country_id: 2017370
description:
2025-07-13 12:18:18 dovecot_login authenticator failed for ([95.79.57.221]) [95.79.57.221]:60622: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.204.231
country_id: 3865483
description:
2025-07-13 12:18:36 dovecot_login authenticator failed for ([186.5.204.231]) [186.5.204.231]:43904: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.213.140.50
country_id: 3017382
description:
Jul 13 12:20:03 servidor sshd[192556]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.213.140.50 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 89.213.140.50
country_id: 3017382
description:
Jul 13 12:20:03 servidor sshd[192556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.213.140.50


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.40.199
country_id: 2750405
description:
Jul 13 12:23:31 servidor sshd[193623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.40.199


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 12:24:01 servidor sshd[193700]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 12:24:01 servidor sshd[193700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.115


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.128.112.74
country_id: 732800
description:
Jul 13 12:26:02 servidor sshd[194166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.128.112.74


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 147.182.206.75
country_id: 6252001
description:
Jul 13 12:26:52 servidor sshd[194460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.182.206.75  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.92.223.147
country_id: 2750405
description:
Jul 13 12:27:36 servidor sshd[194604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.223.147


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.206.75
country_id: 6252001
description:
Jul 13 12:26:52 servidor sshd[194460]: pam_imunify(sshd:auth): [IM360_RBL] The IP 147.182.206.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.98.0
country_id: 1880251
description:
Jul 13 12:30:25 servidor sshd[195314]: pam_imunify(sshd:auth): [IM360_RBL] The IP 134.209.98.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 134.209.98.0
country_id: 1880251
description:
Jul 13 12:30:25 servidor sshd[195314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.98.0  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.40.199
country_id: 2750405
description:
Jul 13 12:31:01 servidor sshd[196120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.40.199


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.48.221
country_id: 1880251
description:
Jul 13 12:31:48 servidor sshd[196350]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.48.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.48.221
country_id: 1880251
description:
Jul 13 12:31:48 servidor sshd[196350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.48.221


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.48.221
country_id: 1880251
description:
Jul 13 12:31:50 servidor sshd[196350]: Failed password for invalid user adcolheita from 157.245.48.221 port 57852 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 12:32:43 -0300] info [cpaneld] 185.243.96.5 - Daniel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Daniel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.207.15.4
country_id: 1814991
description:
2025-07-13 12:32:43 dovecot_login authenticator failed for ([140.207.15.4]) [140.207.15.4]:35202: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.115.125
country_id: 6252001
description:
Jul 13 12:33:02 servidor sshd[196585]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.115.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
country_id: 6252001
description:
Jul 13 12:33:02 servidor sshd[196585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-07-13 12:33:05 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:45213: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:33:58 servidor sshd[196773]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.235.16.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:33:58 servidor sshd[196773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.235.16.111  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:34:10 servidor sshd[196812]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.8.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:34:10 servidor sshd[196812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.8.63  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:35:28 servidor sshd[197323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.8.63  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:35:32 servidor sshd[197329]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.235.16.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:35:32 servidor sshd[197329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.235.16.111  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.92.223.147
country_id: 2750405
description:
Jul 13 12:35:11 servidor sshd[197226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.223.147


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:35:28 servidor sshd[197323]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.8.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.75.185.71
country_id: 1814991
description:
Jul 13 12:34:52 servidor sshd[197007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.75.185.71  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.231.110.214
country_id: 6252001
description:
Jul 13 12:36:46 servidor sshd[197671]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.231.110.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.231.110.214
country_id: 6252001
description:
Jul 13 12:36:46 servidor sshd[197671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.231.110.214  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 12:36:46 servidor sshd[197669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:36:47 servidor sshd[197678]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.235.16.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.235.16.111
country_id: 390903
description:
Jul 13 12:36:47 servidor sshd[197678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.235.16.111  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 207.231.110.214
country_id: 6252001
description:
Jul 13 12:36:48 servidor sshd[197671]: Failed password for root from 207.231.110.214 port 53450 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:36:34 servidor sshd[197500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.8.63  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.8.63
country_id: 2635167
description:
Jul 13 12:36:34 servidor sshd[197500]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.8.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.220.124.69
country_id: 2921044
description:
Jul 13 12:37:08 servidor sshd[197796]: pam_imunify(sshd:auth): [IM360_RBL] The IP 158.220.124.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 158.220.124.69
country_id: 2921044
description:
Jul 13 12:37:08 servidor sshd[197796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.220.124.69


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.40.199
country_id: 2750405
description:
Jul 13 12:38:42 servidor sshd[198108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.40.199


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.92.223.147
country_id: 2750405
description:
Jul 13 12:42:54 servidor sshd[199256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.92.223.147


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.75.185.71
country_id: 1814991
description:
Jul 13 12:44:15 servidor sshd[199749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.75.185.71  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.155.137.173
country_id: 1643084
description:
Jul 13 12:44:46 servidor sshd[199846]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.155.137.173 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.155.137.173
country_id: 1643084
description:
Jul 13 12:44:46 servidor sshd[199846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.155.137.173


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.155.137.173
country_id: 1643084
description:
Jul 13 12:44:49 servidor sshd[199846]: Failed password for invalid user adcolheita from 202.155.137.173 port 57126 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.176.84.4
country_id: 6252001
description:
Jul 13 12:45:07 servidor sshd[200055]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.176.84.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.176.84.4
country_id: 6252001
description:
Jul 13 12:45:07 servidor sshd[200055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.176.84.4  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 88.214.236.61
country_id: 2017370
description:
Jul 13 12:46:32 servidor sshd[201069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.214.236.61  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 12:47:24 servidor sshd[201301]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.75.185.71
country_id: 1814991
description:
Jul 13 12:48:45 servidor sshd[201579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.75.185.71  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.75.185.71
country_id: 1814991
description:
Jul 13 12:48:45 servidor sshd[201579]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.75.185.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.112.127.104
country_id: 2750405
description:
Jul 13 12:50:30 servidor sshd[202040]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.112.127.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.112.127.104
country_id: 2750405
description:
Jul 13 12:50:30 servidor sshd[202040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.112.127.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.3.140.29
country_id: 1814991
description:
2025-07-13 12:50:49 dovecot_login authenticator failed for ([106.3.140.29]) [106.3.140.29]:57088: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.135
country_id: 1835841
description:
2025-07-13 12:51:03 dovecot_login authenticator failed for ([112.172.126.135]) [112.172.126.135]:51432: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.23
country_id: 99237
description:
2025-07-13 12:52:21 dovecot_login authenticator failed for ([65.20.193.23]) [65.20.193.23]:41219: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.87.21.146
country_id: 1814991
description:
2025-07-13 12:52:41 dovecot_login authenticator failed for ([218.87.21.146]) [218.87.21.146]:58817: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 12:52:45 servidor sshd[202576]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 12:52:45 servidor sshd[202576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 12:53:11 servidor sshd[202660]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.130.113.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 12:53:11 servidor sshd[202660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.130.113.204  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 12:53:13 servidor sshd[202660]: Failed password for root from 125.130.113.204 port 42204 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 13:01:24 -0300] info [cpaneld] 185.243.96.5 - Robert "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Robert (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.169.204.193
country_id: 3469034
description:
Jul 13 13:04:43 servidor sshd[207201]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.169.204.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.169.204.193
country_id: 3469034
description:
Jul 13 13:04:43 servidor sshd[207201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.169.204.193


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 13:06:07 servidor sshd[208468]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.173.178
country_id: 1210997
description:
Jul 13 13:06:58 servidor sshd[208604]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.84.173.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.84.173.178
country_id: 1210997
description:
Jul 13 13:06:58 servidor sshd[208604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.84.173.178  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 13:10:36 servidor sshd[209496]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 13:10:36 servidor sshd[209496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 164.52.24.187
country_id: 1861060
description:
Jul 13 13:13:20 servidor dovecot[183307]: pop3-login: Disconnected: Aborted login by logging out (tried to use unsupported auth mechanism): user=<>, method=NTLM, rip=164.52.24.187, lip=69.30.198.27, TLS, session=<jhVf0tE5I9GkNBi7>


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 13:15:02 servidor sshd[211094]: pam_imunify(sshd:auth): [IM360_RBL] The IP 1.226.84.145 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 13:15:02 servidor sshd[211094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.226.84.145  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.197.150.37
country_id: 3057568
description:
2025-07-13 13:14:34 dovecot_login authenticator failed for static-dsl-37.87-197-150.telecom.sk [87.197.150.37]:56685: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-07-13 13:14:48 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:56094: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 13:14:59 servidor sshd[211089]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 13:14:59 servidor sshd[211089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.82.122.238
country_id: 2921044
description:
Jul 13 13:16:44 servidor sshd[212316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.82.122.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.82.122.238
country_id: 2921044
description:
Jul 13 13:16:44 servidor sshd[212316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.122.238  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.47.173.124
country_id: 2921044
description:
Jul 13 13:17:20 servidor sshd[212454]: pam_imunify(sshd:auth): [IM360_RBL] The IP 78.47.173.124 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.47.173.124
country_id: 2921044
description:
Jul 13 13:17:20 servidor sshd[212454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.47.173.124


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 13:20:19 servidor sshd[213262]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:20:35 servidor sshd[213270]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.176.78.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:20:35 servidor sshd[213270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.176.78.178


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:22:05 servidor sshd[213495]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:22:05 servidor sshd[213495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.127  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.77.99
country_id: 2921044
description:
Jul 13 13:23:27 servidor sshd[213759]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.220.77.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.220.77.99
country_id: 2921044
description:
Jul 13 13:23:27 servidor sshd[213759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.220.77.99


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.235.86.152
country_id: 798544
description:
Jul 13 13:24:47 servidor sshd[214083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.235.86.152  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 13:24:21 servidor sshd[214046]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 13:24:21 servidor sshd[214046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.235.86.152
country_id: 798544
description:
Jul 13 13:24:47 servidor sshd[214083]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.235.86.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.77.162
country_id: 878675
description:
Jul 13 13:25:16 servidor sshd[214293]: pam_imunify(sshd:auth): [IM360_RBL] The IP 41.78.77.162 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.78.77.162
country_id: 878675
description:
Jul 13 13:25:16 servidor sshd[214293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.78.77.162


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:25:42 servidor sshd[214400]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.176.78.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:25:42 servidor sshd[214400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.176.78.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-07-13 13:26:36 dovecot_login authenticator failed for ([61.0.236.99]) [182.72.143.2]:42136: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.4.208.216
country_id: 1605651
description:
Jul 13 13:26:43 servidor sshd[214566]: pam_imunify(sshd:auth): [IM360_RBL] The IP 171.4.208.216 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 171.4.208.216
country_id: 1605651
description:
Jul 13 13:26:43 servidor sshd[214566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.4.208.216


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.114.162
country_id: 1269750
description:
2025-07-13 13:26:53 dovecot_login authenticator failed for ([182.95.114.162]) [182.95.114.162]:56134: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 13:26:11 servidor sshd[214462]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 13:26:11 servidor sshd[214462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 13:27:56 servidor sshd[214795]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:27:07 servidor sshd[214626]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.176.78.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:27:07 servidor sshd[214626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.176.78.178


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.78.178
country_id: 1643084
description:
Jul 13 13:27:09 servidor sshd[214626]: Failed password for invalid user test from 103.176.78.178 port 42154 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 13:28:45 -0300] info [cpaneld] 185.243.96.5 - Joseph "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Joseph (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:28:59 servidor sshd[214970]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:28:59 servidor sshd[214970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.127  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.12.204.239
country_id: 2960313
description:
Jul 13 13:29:28 servidor sshd[215212]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.12.204.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.12.204.239
country_id: 2960313
description:
Jul 13 13:29:28 servidor sshd[215212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.12.204.239  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 13:32:23 servidor sshd[216596]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 13:32:23 servidor sshd[216596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.153.34
country_id: 3017382
description:
Jul 13 13:33:54 servidor sshd[216863]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.77.153.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.77.153.34
country_id: 3017382
description:
Jul 13 13:33:54 servidor sshd[216863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.153.34  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.114.45.37
country_id: 2921044
description:
Jul 13 13:33:20 servidor sshd[216776]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.114.45.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.114.45.37
country_id: 2921044
description:
Jul 13 13:33:20 servidor sshd[216776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.114.45.37  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 13:34:11 servidor sshd[217052]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.131.12.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 13:34:11 servidor sshd[217052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.131.12.238  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 13:37:14 servidor sshd[217735]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 13:37:14 servidor sshd[217735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.77.222.24
country_id: 3017382
description:
Jul 13 13:37:47 servidor sshd[217883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.222.24


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.26.186
country_id: 878675
description:
2025-07-13 13:38:10 dovecot_login authenticator failed for ([41.220.26.186]) [41.220.26.186]:44214: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.120.106
country_id: 1814991
description:
2025-07-13 13:38:43 dovecot_login authenticator failed for ([124.67.120.106]) [124.67.120.106]:46403: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
country_id: 1835841
description:
Jul 13 13:38:52 servidor sshd[218169]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
country_id: 1835841
description:
Jul 13 13:38:52 servidor sshd[218169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 221.156.137.104
country_id: 1835841
description:
Jul 13 13:38:53 servidor sshd[218169]: Failed password for root from 221.156.137.104 port 35124 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 13:39:11 servidor sshd[218371]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 13:39:11 servidor sshd[218371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.141.31.119
country_id: 1814991
description:
Jul 13 13:39:58 servidor sshd[218557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.141.31.119  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
country_id: 1835841
description:
Jul 13 13:46:35 servidor sshd[5621]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
country_id: 1835841
description:
Jul 13 13:46:35 servidor sshd[5621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.20.18.85
country_id: 617790
description:
Jul 13 13:48:21 servidor sshd[6018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.20.18.85


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2025-07-13 13:49:54 dovecot_login authenticator failed for 217.42.246.220.static.netvigator.com [220.246.42.217]:63827: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.136.243
country_id: 1562822
description:
2025-07-13 13:50:09 dovecot_login authenticator failed for ([45.118.136.243]) [45.118.136.243]:58841: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.30
country_id: 1269750
description:
Jul 13 13:54:22 servidor sshd[7686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.30  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:54:39 servidor sshd[7973]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 13:54:39 servidor sshd[7973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.127  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.4.103.61
country_id: 1168579
description:
2025-07-13 13:56:19 dovecot_login authenticator failed for ([103.4.103.61]) [103.4.103.61]:33058: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 13:56:28 -0300] info [cpaneld] 185.243.96.5 - William "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user William (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.188.56.8
country_id: 2017370
description:
2025-07-13 13:56:43 dovecot_login authenticator failed for ([94.188.56.8]) [94.188.56.8]:49218: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
country_id: 294640
description:
2025-07-13 13:58:04 dovecot_login authenticator failed for ([85.159.164.28]) [85.159.164.28]:60720: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.247.160.143
country_id: 2921044
description:
Jul 13 13:58:25 servidor sshd[9652]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.247.160.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-07-13 13:58:57 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:57492: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
country_id: 1835841
description:
Jul 13 13:58:19 servidor sshd[9635]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
country_id: 1835841
description:
Jul 13 13:58:19 servidor sshd[9635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.247.160.143
country_id: 2921044
description:
Jul 13 13:58:25 servidor sshd[9652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.247.160.143


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.175.4
country_id: 1562822
description:
Jul 13 13:58:27 servidor sshd[9657]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.191.175.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.191.175.4
country_id: 1562822
description:
Jul 13 13:58:27 servidor sshd[9657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.191.175.4  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.30
country_id: 1269750
description:
Jul 13 13:58:29 servidor sshd[9663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.30  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.74.243.183
country_id: 1562822
description:
2025-07-13 13:58:45 dovecot_login authenticator failed for ([14.224.208.174]) [27.74.243.183]:36898: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.30
country_id: 1269750
description:
Jul 13 13:59:56 servidor sshd[10050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.30  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 13:59:27 servidor sshd[9950]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 13:59:27 servidor sshd[9950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 14:00:26 servidor sshd[10342]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 14:00:26 servidor sshd[10342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 14:00:28 servidor sshd[10342]: Failed password for redestreamhost from 82.151.65.155 port 41876 ssh2


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 14:01:19 servidor sshd[10528]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 14:01:38 servidor sshd[10588]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 14:01:38 servidor sshd[10588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.127  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.118.48.136
country_id: 1562822
description:
Jul 13 14:09:10 servidor sshd[12199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.118.48.136  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 14:10:45 servidor sshd[12722]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 14:10:45 servidor sshd[12722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.201.4.38
country_id: 458258
description:
Jul 13 14:13:14 servidor sshd[14243]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.201.4.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 89.201.4.38
country_id: 458258
description:
Jul 13 14:13:14 servidor sshd[14243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.201.4.38  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.158.60.90
country_id: 3017382
description:
Jul 13 14:13:52 servidor sshd[14384]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.158.60.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.158.60.90
country_id: 3017382
description:
Jul 13 14:13:52 servidor sshd[14384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.60.90


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 14:15:09 servidor sshd[14874]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 14:15:09 servidor sshd[14874]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.83.126
country_id: 3469034
description:
Jul 13 14:14:40 servidor sshd[14482]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.36.83.126 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.36.83.126
country_id: 3469034
description:
Jul 13 14:14:40 servidor sshd[14482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.36.83.126


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.95.111.118
country_id: 1562822
description:
Jul 13 14:15:24 servidor sshd[14920]: pam_imunify(sshd:auth): [IM360_RBL] The IP 150.95.111.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 150.95.111.118
country_id: 1562822
description:
Jul 13 14:15:24 servidor sshd[14920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.95.111.118  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.138.59.242
country_id: 6252001
description:
Jul 13 14:23:40 servidor sshd[16695]: pam_imunify(sshd:auth): [IM360_RBL] The IP 174.138.59.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 174.138.59.242
country_id: 6252001
description:
Jul 13 14:23:40 servidor sshd[16695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.59.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 14:24:38 -0300] info [cpaneld] 185.243.96.5 - Jason "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Jason (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 14:25:55 servidor sshd[17450]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.120.215
country_id: 1814991
description:
Jul 13 14:26:57 servidor sshd[17782]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.120.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.120.215
country_id: 1814991
description:
Jul 13 14:26:57 servidor sshd[17782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.120.215  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 14:27:24 servidor sshd[17915]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.123.109.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.109.127
country_id: 732800
description:
Jul 13 14:27:24 servidor sshd[17915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.109.127  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
country_id: 1562822
description:
Jul 13 14:27:29 servidor sshd[17928]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
country_id: 1562822
description:
Jul 13 14:27:29 servidor sshd[17928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-07-13 14:29:02 dovecot_login authenticator failed for ([103.203.210.119]) [103.203.210.119]:34597: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.74.9.190
country_id: 1814991
description:
2025-07-13 14:29:15 dovecot_login authenticator failed for ([101.230.0.49]) [124.74.9.190]:56916: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 14:29:44 servidor sshd[19334]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 14:29:44 servidor sshd[19334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 14:32:33 servidor sshd[20390]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 14:32:33 servidor sshd[20390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.65.121.222
country_id: 3017382
description:
Jul 13 14:33:58 servidor sshd[20666]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.65.121.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.65.121.222
country_id: 3017382
description:
Jul 13 14:33:58 servidor sshd[20666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.65.121.222  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.128.112.74
country_id: 732800
description:
Jul 13 14:34:45 servidor sshd[20834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.128.112.74


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.164
country_id: 6252001
description:
Jul 13 14:36:16 servidor sshd[21409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.164


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.148.77.164
country_id: 6252001
description:
Jul 13 14:36:18 servidor sshd[21409]: Failed password for invalid user test from 132.148.77.164 port 50438 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.148.77.164
country_id: 6252001
description:
Jul 13 14:36:16 servidor sshd[21409]: pam_imunify(sshd:auth): [IM360_RBL] The IP 132.148.77.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.60.252.70
country_id: 2921044
description:
Jul 13 14:38:22 servidor sshd[22003]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.60.252.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.60.252.70
country_id: 2921044
description:
Jul 13 14:38:22 servidor sshd[22003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.60.252.70


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.213.120.14
country_id: 2921044
description:
Jul 13 14:40:28 servidor sshd[22552]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.213.120.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 89.213.120.14
country_id: 2921044
description:
Jul 13 14:40:28 servidor sshd[22552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.213.120.14


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:40:43 servidor sshd[22568]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.250.72.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:40:43 servidor sshd[22568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.250.72.168  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:41:53 servidor sshd[22776]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.176.12.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:41:53 servidor sshd[22776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.176.12.6  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 14:42:36 servidor sshd[23054]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.38.121.43
country_id: 1835841
description:
Jul 13 14:42:52 servidor sshd[23516]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.38.121.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.38.121.43
country_id: 1835841
description:
Jul 13 14:42:52 servidor sshd[23516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.38.121.43  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
country_id: 3996063
description:
Jul 13 14:43:52 servidor sshd[24169]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
country_id: 3996063
description:
Jul 13 14:43:52 servidor sshd[24169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.112.100
country_id: 1814991
description:
Jul 13 14:43:27 servidor sshd[24138]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.112.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.112.100
country_id: 1814991
description:
Jul 13 14:43:27 servidor sshd[24138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.112.100  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:44:34 servidor sshd[24320]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.250.72.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:44:34 servidor sshd[24320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.250.72.168  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.240.229.18
country_id: 2264397
description:
2025-07-13 14:45:19 dovecot_login authenticator failed for bl7-229-18.dsl.telepac.pt [85.240.229.18]:58706: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.15.163.18
country_id: 6252001
description:
2025-07-13 14:45:37 dovecot_login authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:59443: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:45:43 servidor sshd[24644]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.176.12.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:45:43 servidor sshd[24644]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.176.12.6  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:45:51 servidor sshd[24672]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.250.72.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.250.72.168
country_id: 174982
description:
Jul 13 14:45:51 servidor sshd[24672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.250.72.168  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:46:47 servidor sshd[24857]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.176.12.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.176.12.6
country_id: 3469034
description:
Jul 13 14:46:47 servidor sshd[24857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.176.12.6  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.37
country_id: 6252001
description:
Jul 13 14:47:49 servidor sshd[25207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.37


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 14:49:46 servidor sshd[25571]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 14:53:02 -0300] info [cpaneld] 185.243.96.5 - Andrew "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Andrew (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.112.100
country_id: 1814991
description:
Jul 13 14:53:20 servidor sshd[26488]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.112.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.112.100
country_id: 1814991
description:
Jul 13 14:53:20 servidor sshd[26488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.112.100  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 14:54:44 servidor sshd[26750]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 14:54:44 servidor sshd[26750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.241.125.180
country_id: 6252001
description:
Jul 13 14:56:15 servidor sshd[27330]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.241.125.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.241.125.180
country_id: 6252001
description:
Jul 13 14:56:15 servidor sshd[27330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.241.125.180


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 14:58:36 servidor sshd[28910]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.153.241
country_id: 1880251
description:
Jul 13 14:58:19 servidor sshd[28808]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.153.241 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.153.241
country_id: 1880251
description:
Jul 13 14:58:19 servidor sshd[28808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.153.241  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.112.100
country_id: 1814991
description:
Jul 13 15:00:02 servidor sshd[29093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.112.100  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.26.96.232
country_id: 6252001
description:
Jul 13 15:00:24 servidor sshd[29360]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.26.96.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.26.96.232
country_id: 6252001
description:
Jul 13 15:00:24 servidor sshd[29360]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.26.96.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.57.174
country_id: 1835841
description:
2025-07-13 15:00:35 dovecot_login authenticator failed for ([59.7.57.174]) [59.7.57.174]:55528: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.86.148.38
country_id: 1814991
description:
2025-07-13 15:01:18 dovecot_login authenticator failed for ([223.86.148.38]) [223.86.148.38]:29350: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.87.128
country_id: 2921044
description:
Jul 13 15:01:29 servidor sshd[29555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.87.128  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 15:05:47 servidor sshd[30575]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 15:05:47 servidor sshd[30575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 15:06:19 servidor sshd[30666]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 15:06:19 servidor sshd[30666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.103.34.243
country_id: 298795
description:
Jul 13 15:07:41 servidor sshd[30919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.103.34.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.103.34.243
country_id: 298795
description:
Jul 13 15:07:41 servidor sshd[30919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.103.34.243  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.196.204.223
country_id: 3017382
description:
Jul 13 15:09:06 servidor sshd[31534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.196.204.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.196.204.223
country_id: 3017382
description:
Jul 13 15:09:06 servidor sshd[31534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.204.223


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 15:08:19 servidor sshd[31252]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 15:08:19 servidor sshd[31252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-07-13 15:13:01 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:33270: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 15:13:49 servidor sshd[33842]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.216.193.28
country_id: 1835841
description:
2025-07-13 15:13:19 dovecot_login authenticator failed for ([211.216.193.28]) [211.216.193.28]:28921: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.212.103.171
country_id: 798549
description:
Jul 13 15:13:25 servidor sshd[33750]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.212.103.171 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.212.103.171
country_id: 798549
description:
Jul 13 15:13:25 servidor sshd[33750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.212.103.171  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.12.247.56
country_id: 2750405
description:
Jul 13 15:14:24 servidor sshd[34050]: pam_imunify(sshd:auth): [IM360_RBL] The IP 149.12.247.56 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 149.12.247.56
country_id: 2750405
description:
Jul 13 15:14:24 servidor sshd[34050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.12.247.56  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.90.222.0
country_id: 2921044
description:
Jul 13 15:16:03 servidor sshd[34591]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.90.222.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.90.222.0
country_id: 2921044
description:
Jul 13 15:16:03 servidor sshd[34591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.90.222.0


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.167.66.226
country_id: 6252001
description:
Jul 13 15:18:46 servidor sshd[35067]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.167.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.167.66.226
country_id: 6252001
description:
Jul 13 15:18:46 servidor sshd[35067]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.167.66.226  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 15:19:24 servidor sshd[35253]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 15:19:24 servidor sshd[35253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.61.162.81
country_id: 6252001
description:
Jul 13 15:19:25 servidor sshd[35257]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.61.162.81 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.61.162.81
country_id: 6252001
description:
Jul 13 15:19:25 servidor sshd[35257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.61.162.81


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 15:20:49 -0300] info [cpaneld] 185.243.96.5 - Ryan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Ryan (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.110.157.47
country_id: 2750405
description:
Jul 13 15:21:21 servidor sshd[35897]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.110.157.47 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.110.157.47
country_id: 2750405
description:
Jul 13 15:21:21 servidor sshd[35897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.110.157.47  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 15:22:30 servidor sshd[36104]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.71
country_id: 99237
description:
2025-07-13 15:24:24 dovecot_login authenticator failed for ([65.20.129.71]) [65.20.129.71]:38431: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
country_id: 6252001
description:
2025-07-13 15:24:41 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:48324: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:27:28 servidor sshd[37305]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.42.133.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:27:28 servidor sshd[37305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.42.133.43


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.170.129.195
country_id: 1605651
description:
Jul 13 15:27:54 servidor sshd[38270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.170.129.195


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 15:28:18 servidor sshd[38409]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.130.95.240
country_id: 1835841
description:
Jul 13 15:28:26 servidor sshd[38413]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.130.95.240 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.130.95.240
country_id: 1835841
description:
Jul 13 15:28:26 servidor sshd[38413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.130.95.240


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 15:28:43 servidor sshd[38652]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 15:28:43 servidor sshd[38652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.96.243.157
country_id: 1512440
description:
Jul 13 15:29:25 servidor sshd[38847]: pam_imunify(sshd:auth): [IM360_RBL] The IP 176.96.243.157 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.96.243.157
country_id: 1512440
description:
Jul 13 15:29:25 servidor sshd[38847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.96.243.157  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:30:12 servidor sshd[39274]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.42.133.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:30:12 servidor sshd[39274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.42.133.43


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul 13 15:30:24 servidor dovecot[39428]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:30:15 servidor sshd[39274]: Disconnected from invalid user runcloud 111.42.133.43 port 26789 [preauth]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:31:51 servidor sshd[40630]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.42.133.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:31:51 servidor sshd[40630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.42.133.43


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.42.133.43
country_id: 1814991
description:
Jul 13 15:31:52 servidor sshd[40630]: Failed password for invalid user builder from 111.42.133.43 port 26804 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 13 15:32:52 servidor sshd[40885]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.65 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 13 15:32:52 servidor sshd[40885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.65  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.172.91.112
country_id: 1880251
description:
Jul 13 15:33:52 servidor sshd[41104]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.172.91.112 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.172.91.112
country_id: 1880251
description:
Jul 13 15:33:52 servidor sshd[41104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.91.112  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.180.255.136
country_id: 6252001
description:
Jul 13 15:35:14 servidor sshd[41558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.180.255.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.180.255.136
country_id: 6252001
description:
Jul 13 15:35:14 servidor sshd[41558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.180.255.136


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.180.255.136
country_id: 6252001
description:
Jul 13 15:35:16 servidor sshd[41558]: Failed password for invalid user perl from 5.180.255.136 port 35302 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.76.166.65
country_id: 1814991
description:
Jul 13 15:35:43 servidor sshd[41724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.166.65  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
country_id: 1835841
description:
2025-07-13 15:35:45 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:33384: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-07-13 15:35:59 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:44750: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.76.166.65
country_id: 1814991
description:
Jul 13 15:36:22 servidor sshd[41863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.166.65  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.12.247.25
country_id: 2750405
description:
Jul 13 15:38:20 servidor sshd[42276]: pam_imunify(sshd:auth): [IM360_RBL] The IP 149.12.247.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 15:39:00 servidor sshd[42359]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 15:39:00 servidor sshd[42359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.50.177.48
country_id: 1562822
description:
Jul 13 15:38:52 servidor sshd[42315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.50.177.48  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.144.234
country_id: 3469034
description:
Jul 13 15:38:56 servidor sshd[42323]: pam_imunify(sshd:auth): [IM360_RBL] The IP 168.196.144.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 168.196.144.234
country_id: 3469034
description:
Jul 13 15:38:56 servidor sshd[42323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.196.144.234


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 149.12.247.25
country_id: 2750405
description:
Jul 13 15:38:20 servidor sshd[42276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.12.247.25  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.50.177.48
country_id: 1562822
description:
Jul 13 15:38:52 servidor sshd[42315]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.50.177.48 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 15:42:52 servidor sshd[43395]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 15:45:07 servidor sshd[44198]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.108.192
country_id: 3017382
description:
Jul 13 15:44:20 servidor sshd[43757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.108.192  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.130.255.8
country_id: 1643084
description:
Jul 13 15:44:32 servidor sshd[43975]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.130.255.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.108.192
country_id: 3017382
description:
Jul 13 15:44:20 servidor sshd[43757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.108.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.130.255.8
country_id: 1643084
description:
Jul 13 15:44:32 servidor sshd[43975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.130.255.8


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 15:45:07 servidor sshd[44198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.23.54
country_id: 2635167
description:
Jul 13 15:47:13 servidor sshd[45655]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.23.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.23.54
country_id: 2635167
description:
Jul 13 15:47:13 servidor sshd[45655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.23.54


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 15:47:32 servidor sshd[45751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.81


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 15:47:32 servidor sshd[45751]: Invalid user radiomusicclassicsfm from 92.118.39.81 port 34732


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.81
country_id: 6252001
description:
Jul 13 15:47:32 servidor sshd[45751]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 15:49:23 -0300] info [cpaneld] 185.243.96.5 - Anthony "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Anthony (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.152.138.9
country_id: 1643084
description:
Jul 13 15:51:00 servidor sshd[46502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.152.138.9  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.53.253.2
country_id: 1814991
description:
Jul 13 15:51:23 servidor sshd[46626]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.53.253.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.53.253.2
country_id: 1814991
description:
Jul 13 15:51:23 servidor sshd[46626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.53.253.2  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 15:55:55 servidor sshd[47649]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2025-07-13 15:55:45 dovecot_login authenticator failed for ([39.125.67.109]) [39.125.67.109]:57355: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
country_id: 1814991
description:
2025-07-13 15:56:11 dovecot_login authenticator failed for ([111.53.129.92]) [111.53.129.92]:36284: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.123.153.214
country_id: 1814991
description:
2025-07-13 15:56:40 dovecot_login authenticator failed for ([144.123.153.214]) [144.123.153.214]:42032: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 15:57:09 servidor sshd[48229]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 15:57:09 servidor sshd[48229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34  user=mumbacafm


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 15:57:13 servidor sshd[48235]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 15:57:13 servidor sshd[48235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.234.220.212
country_id: 6252001
description:
Jul 13 15:56:48 servidor sshd[47817]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.234.220.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.234.220.212
country_id: 6252001
description:
Jul 13 15:56:48 servidor sshd[47817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.234.220.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.108.124
country_id: 1819730
description:
2025-07-13 15:57:00 dovecot_login authenticator failed for ([45.251.108.124]) [45.251.108.124]:51129: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 15:57:11 servidor sshd[48229]: Failed password for mumbacafm from 92.118.39.34 port 41118 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.89.127.232
country_id: 2921044
description:
Jul 13 15:57:35 servidor sshd[48343]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.89.127.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.89.127.232
country_id: 2921044
description:
Jul 13 15:57:35 servidor sshd[48343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.89.127.232  user=root


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 86.54.31.38
country_id: 6251999
description:
Jul 13 15:57:36 servidor dovecot[39435]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 4 secs): user=<>, rip=86.54.31.38, lip=69.30.198.26, TLS, session=<K5jYHdQ5NuBWNh8m>


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.169.226.134
country_id: 6252001
description:
Jul 13 15:59:28 servidor sshd[48750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.226.134


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.226.134
country_id: 6252001
description:
Jul 13 15:59:28 servidor sshd[48750]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.169.226.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.67.208.20
country_id: 6252001
description:
Jul 13 16:01:55 servidor sshd[50240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.67.208.20  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
country_id: 1835841
description:
Jul 13 16:01:29 servidor sshd[50213]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
country_id: 1835841
description:
Jul 13 16:01:29 servidor sshd[50213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:02:59 servidor sshd[50592]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.85.152.42 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:02:59 servidor sshd[50592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.85.152.42  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:03:21 servidor sshd[50668]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.23.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:03:21 servidor sshd[50668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.23.51  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.105.56
country_id: 1814991
description:
Jul 13 16:03:39 servidor sshd[50740]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.105.56 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.105.56
country_id: 1814991
description:
Jul 13 16:03:39 servidor sshd[50740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.105.56  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.224.115.232
country_id: 1814991
description:
Jul 13 16:05:13 servidor sshd[51109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.224.115.232  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:06:06 servidor sshd[51275]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.13.244.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:06:06 servidor sshd[51275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.13.244.219  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:05:22 servidor sshd[51145]: pam_imunify(sshd:auth): [IM360_RBL] The IP 123.58.209.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:05:22 servidor sshd[51145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.58.209.115  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:07:14 servidor sshd[51498]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.85.152.42 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:06:43 servidor sshd[51378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.213.64  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:07:02 servidor sshd[51477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.23.51  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:07:11 servidor sshd[51484]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:07:11 servidor sshd[51484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.95  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:06:43 servidor sshd[51378]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.213.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:07:02 servidor sshd[51477]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.23.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:07:14 servidor sshd[51498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.85.152.42  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:07:55 servidor sshd[51609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.58.209.115  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:08:08 servidor sshd[51801]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.13.244.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:08:08 servidor sshd[51801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.13.244.219  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:08:08 servidor sshd[51803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.23.51  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.156.22.114
country_id: 798549
description:
Jul 13 16:07:52 servidor sshd[51604]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.156.22.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.156.22.114
country_id: 798549
description:
Jul 13 16:07:52 servidor sshd[51604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.156.22.114


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:07:55 servidor sshd[51609]: pam_imunify(sshd:auth): [IM360_RBL] The IP 123.58.209.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.23.51
country_id: 2635167
description:
Jul 13 16:08:08 servidor sshd[51803]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.23.51 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:08:58 servidor sshd[52024]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:08:41 servidor sshd[51953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.95  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:08:45 servidor sshd[51957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.85.152.42  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:09:02 servidor sshd[52070]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.213.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.152.42
country_id: 3469034
description:
Jul 13 16:08:45 servidor sshd[51957]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.85.152.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:08:41 servidor sshd[51953]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.95 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.236.46
country_id: 1643084
description:
[2025-07-13 16:08:59 -0300] info [whostmgrd] 103.65.236.46 - distakec "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:09:02 servidor sshd[52070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.213.64  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:09:13 servidor sshd[52085]: pam_imunify(sshd:auth): [IM360_RBL] The IP 123.58.209.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 123.58.209.115
country_id: 1819730
description:
Jul 13 16:09:13 servidor sshd[52085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.58.209.115  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:09:30 servidor sshd[52169]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.13.244.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.13.244.219
country_id: 3686110
description:
Jul 13 16:09:30 servidor sshd[52169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.13.244.219  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:09:55 servidor sshd[52312]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.95
country_id: 130758
description:
Jul 13 16:09:55 servidor sshd[52312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.95  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.224.115.232
country_id: 1814991
description:
Jul 13 16:09:57 servidor sshd[52314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.224.115.232  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:10:33 servidor sshd[52640]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.224.115.232
country_id: 1814991
description:
Jul 13 16:10:50 servidor sshd[52712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.224.115.232  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.248.200.76
country_id: 2750405
description:
2025-07-13 16:11:43 dovecot_login authenticator failed for ([104.248.200.76]) [104.248.200.76]:38728: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.241.234
country_id: 1814991
description:
2025-07-13 16:11:56 dovecot_login authenticator failed for ([210.22.130.22]) [58.246.241.234]:50103: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:11:56 servidor sshd[52944]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.213.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.213.64
country_id: 1814991
description:
Jul 13 16:11:56 servidor sshd[52944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.213.64  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.244.35
country_id: 1562822
description:
Jul 13 16:15:30 servidor sshd[55431]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.212.244.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.244.35
country_id: 1562822
description:
Jul 13 16:15:30 servidor sshd[55431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.244.35


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 24.144.87.77
country_id: 6252001
description:
Jul 13 16:15:33 servidor sshd[55434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.144.87.77


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.105.56
country_id: 1814991
description:
Jul 13 16:16:03 servidor sshd[55461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.105.56  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 16:16:32 servidor sshd[55599]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 16:16:32 servidor sshd[55599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.208.9.124
country_id: 2750405
description:
Jul 13 16:16:50 servidor sshd[55633]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.208.9.124 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.208.9.124
country_id: 2750405
description:
Jul 13 16:16:50 servidor sshd[55633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.208.9.124


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 16:17:59 -0300] info [cpaneld] 185.243.96.5 - Jacob "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Jacob (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.105.56
country_id: 1814991
description:
Jul 13 16:18:51 servidor sshd[56123]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.105.56 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.105.56
country_id: 1814991
description:
Jul 13 16:18:51 servidor sshd[56123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.105.56  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.206.12.13
country_id: 1835841
description:
Jul 13 16:19:20 servidor sshd[56297]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.206.12.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.206.12.13
country_id: 1835841
description:
Jul 13 16:19:20 servidor sshd[56297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.206.12.13


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.234.220.213
country_id: 6252001
description:
Jul 13 16:19:23 servidor sshd[56301]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.234.220.213 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.234.220.213
country_id: 6252001
description:
Jul 13 16:19:23 servidor sshd[56301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.234.220.213  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:21:37 servidor sshd[56814]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.70.149.210
country_id: 1814991
description:
2025-07-13 16:21:42 dovecot_login authenticator failed for ([223.70.149.210]) [223.70.149.210]:37874: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-07-13 16:22:00 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:39718: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.108
country_id: 732800
description:
Jul 13 16:24:55 servidor sshd[57489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.108  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 13 16:24:37 servidor sshd[57447]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.65 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.65
country_id: 1835841
description:
Jul 13 16:24:37 servidor sshd[57447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.65  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.167.38.134
country_id: 6252001
description:
Jul 13 16:25:44 servidor sshd[57862]: pam_imunify(sshd:auth): [IM360_RBL] The IP 72.167.38.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 72.167.38.134
country_id: 6252001
description:
Jul 13 16:25:44 servidor sshd[57862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=72.167.38.134


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.126.101.102
country_id: 6252001
description:
Jul 13 16:27:56 servidor sshd[58230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.126.101.102  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 16:30:54 servidor sshd[60013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Jul 13 16:30:54 servidor sshd[60013]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.36.253
country_id: 2921044
description:
Jul 13 16:37:33 servidor sshd[61451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.36.253


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.36.253
country_id: 2921044
description:
Jul 13 16:37:33 servidor sshd[61451]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.36.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 16:39:42 servidor sshd[62122]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.130.113.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.130.113.204
country_id: 1835841
description:
Jul 13 16:39:42 servidor sshd[62122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.130.113.204  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.74.235.208
country_id: 6252001
description:
2025-07-13 16:40:01 dovecot_login authenticator failed for syn-074-074-235-208.res.spectrum.com [74.74.235.208]:49382: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
country_id: 2661886
description:
2025-07-13 16:40:18 dovecot_login authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:34088: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.128.112.74
country_id: 732800
description:
Jul 13 16:40:44 servidor sshd[62575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.128.112.74


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:43:21 servidor sshd[63010]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.21.215
country_id: 2750405
description:
Jul 13 16:45:29 servidor sshd[64621]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.21.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.21.215
country_id: 2750405
description:
Jul 13 16:45:29 servidor sshd[64621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.21.215


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 16:46:37 servidor sshd[64870]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 16:46:37 servidor sshd[64870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 16:46:38 -0300] info [cpaneld] 185.243.96.5 - Nicholas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Nicholas (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:47:17 servidor sshd[64977]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.102.63
country_id: 1880251
description:
Jul 13 16:47:33 servidor sshd[64991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.102.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.102.63
country_id: 1880251
description:
Jul 13 16:47:33 servidor sshd[64991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.102.63


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 16:47:58 servidor sshd[65083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.99.243
country_id: 1880251
description:
Jul 13 16:48:17 servidor sshd[65174]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.99.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.99.243
country_id: 1880251
description:
Jul 13 16:48:17 servidor sshd[65174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.99.243


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.180.141.230
country_id: 3658394
description:
[2025-07-13 16:49:35 -0300] info [whostmgrd] 45.180.141.230 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-07-13 16:51:48 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:53986: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.65.62.234
country_id: 3686110
description:
2025-07-13 16:51:33 dovecot_login authenticator failed for ([190.65.62.235]) [190.65.62.234]:62348: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.202.236.219
country_id: 2921044
description:
Jul 13 16:51:45 servidor sshd[66024]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.202.236.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.202.236.219
country_id: 2921044
description:
Jul 13 16:51:45 servidor sshd[66024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.202.236.219


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
country_id: 2510769
description:
Jul 13 16:52:23 servidor sshd[66106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 16:52:50 servidor sshd[66186]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 16:52:50 servidor sshd[66186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
country_id: 2510769
description:
Jul 13 16:52:23 servidor sshd[66106]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 16:59:47 servidor sshd[67692]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.18.215
country_id: 3017382
description:
Jul 13 16:59:43 servidor sshd[67683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.18.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.18.215
country_id: 3017382
description:
Jul 13 16:59:43 servidor sshd[67683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.18.215  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.1.60.243
country_id: 1605651
description:
Jul 13 17:01:50 servidor sshd[69579]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.1.60.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.1.60.243
country_id: 1605651
description:
Jul 13 17:01:50 servidor sshd[69579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.1.60.243


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 17:01:59 servidor sshd[69645]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 17:01:59 servidor sshd[69645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-07-13 17:02:14 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:60409: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.0.192.86
country_id: 2017370
description:
2025-07-13 17:02:31 dovecot_login authenticator failed for (46x0x192x86.static-customer.samara.ertelecom.ru) [46.0.192.86]:60948: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 17:07:04 servidor sshd[70833]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 17:07:04 servidor sshd[70833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101  user=root


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.109
country_id: 2635167
description:
Jul 13 17:08:13 servidor dovecot[39435]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.109, lip=69.30.198.26, TLS, session=<VAdiGtU5f8NX7LBt>


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.178.137.243
country_id: 3017382
description:
Jul 13 17:08:07 servidor sshd[71057]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.178.137.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.178.137.243
country_id: 3017382
description:
Jul 13 17:08:07 servidor sshd[71057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.137.243  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 17:11:47 servidor sshd[71791]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.88.9
country_id: 1880251
description:
Jul 13 17:11:29 servidor sshd[71756]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.88.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.88.9
country_id: 1880251
description:
Jul 13 17:11:29 servidor sshd[71756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.88.9


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 17:12:51 servidor sshd[72121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.131.12.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.131.12.238
country_id: 1814991
description:
Jul 13 17:12:51 servidor sshd[72121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.131.12.238  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.166
country_id: 1814991
description:
2025-07-13 17:13:44 dovecot_login authenticator failed for ([1.31.80.166]) [1.31.80.166]:36402: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.51.50
country_id: 953987
description:
2025-07-13 17:14:00 dovecot_login authenticator failed for (102.221.51.50) [102.221.51.50]:48520: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.130.219.128
country_id: 1562822
description:
Jul 13 17:14:22 servidor sshd[72473]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.130.219.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.130.219.128
country_id: 1562822
description:
Jul 13 17:14:22 servidor sshd[72473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.130.219.128  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 17:15:16 -0300] info [cpaneld] 185.243.96.5 - Brian "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Brian (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 17:15:32 servidor sshd[73826]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 17:15:32 servidor sshd[73826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.115  user=mumbacafm


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 17:15:34 servidor sshd[73826]: Failed password for mumbacafm from 92.118.39.115 port 51782 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.151.53
country_id: 953987
description:
Jul 13 17:15:43 servidor sshd[73868]: pam_imunify(sshd:auth): [IM360_RBL] The IP 197.242.151.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 197.242.151.53
country_id: 953987
description:
Jul 13 17:15:43 servidor sshd[73868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.242.151.53  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-07-13 17:19:35 dovecot_login authenticator failed for ([213.230.64.246]) [213.230.64.246]:35674: 535 Incorrect authentication data (set_id=comercial@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.23
country_id: 99237
description:
2025-07-13 17:20:00 dovecot_login authenticator failed for ([65.20.193.23]) [65.20.193.23]:48735: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 17:20:37 servidor sshd[74973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.77.162
country_id: 878675
description:
Jul 13 17:20:37 servidor sshd[74971]: pam_imunify(sshd:auth): [IM360_RBL] The IP 41.78.77.162 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.78.77.162
country_id: 878675
description:
Jul 13 17:20:37 servidor sshd[74971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.78.77.162  user=ftp


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 17:20:31 servidor sshd[74942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 17:20:37 servidor sshd[74973]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 17:20:25 servidor sshd[74921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 17:20:31 servidor sshd[74942]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 17:22:34 servidor sshd[75334]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.161.62.169
country_id: 6252001
description:
Jul 13 17:26:10 servidor sshd[76306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.161.62.169  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 17:27:39 servidor sshd[76828]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 17:27:39 servidor sshd[76828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.130.221
country_id: 6252001
description:
Jul 13 17:28:00 servidor sshd[76854]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.130.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.130.221
country_id: 6252001
description:
Jul 13 17:28:00 servidor sshd[76854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.130.221  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2025-07-13 17:28:26 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:43325: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.227.238.172
country_id: 6252001
description:
2025-07-13 17:28:38 dovecot_login authenticator failed for ([50.227.238.172]) [50.227.238.172]:43179: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 17:30:25 servidor sshd[78312]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.101
country_id: 6252001
description:
Jul 13 17:30:25 servidor sshd[78312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.101  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 17:31:18 servidor sshd[78869]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 17:33:17 servidor sshd[79283]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.38.102
country_id: 1562822
description:
Jul 13 17:33:58 servidor sshd[79526]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.38.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.38.102
country_id: 1562822
description:
Jul 13 17:33:58 servidor sshd[79526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.38.102


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.203.212
country_id: 1643084
description:
Jul 13 17:37:58 servidor sshd[80466]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.146.203.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.146.203.212
country_id: 1643084
description:
Jul 13 17:37:58 servidor sshd[80466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.146.203.212


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.90.149.164
country_id: 6252001
description:
Jul 13 17:38:33 servidor sshd[80845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.90.149.164


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:38:45 servidor sshd[80871]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.92.199.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:38:45 servidor sshd[80871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.92.199.36


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.90.149.164
country_id: 6252001
description:
Jul 13 17:38:33 servidor sshd[80845]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.90.149.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 17:39:19 servidor sshd[81154]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 17:39:19 servidor sshd[81154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.212
country_id: 1814991
description:
Jul 13 17:39:46 servidor sshd[81262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.212


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:40:48 servidor sshd[81573]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.181.142.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:40:48 servidor sshd[81573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.142.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:42:40 servidor sshd[82234]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.92.199.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:42:40 servidor sshd[82234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.92.199.36


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:43:55 servidor sshd[82470]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.92.199.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:43:55 servidor sshd[82470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.92.199.36


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:43:56 servidor sshd[82469]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.137.34.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.249.150.91
country_id: 2921044
description:
Jul 13 17:43:26 servidor sshd[82361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.249.150.91  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:43:56 servidor sshd[82469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.137.34.110


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.199.36
country_id: 732800
description:
Jul 13 17:43:57 servidor sshd[82470]: Failed password for invalid user upload from 91.92.199.36 port 33208 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 17:44:05 -0300] info [cpaneld] 185.243.96.5 - Justin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Justin (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:44:34 servidor sshd[82811]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.181.142.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:44:34 servidor sshd[82811]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.142.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.212
country_id: 1814991
description:
Jul 13 17:44:58 servidor sshd[82857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.212


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:45:54 servidor sshd[84262]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.181.142.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.181.142.227
country_id: 1643084
description:
Jul 13 17:45:54 servidor sshd[84262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.181.142.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:45:57 servidor sshd[84267]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.207.200.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:45:57 servidor sshd[84267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.207.200.77


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.103.115.212
country_id: 1814991
description:
Jul 13 17:45:03 servidor sshd[82857]: Disconnected from invalid user streaming 14.103.115.212 port 42934 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.212
country_id: 1814991
description:
Jul 13 17:46:07 servidor sshd[84352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.212


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.124.154.83
country_id: 1880251
description:
Jul 13 17:46:31 servidor sshd[84426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.124.154.83


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.182.74.203
country_id: 798544
description:
Jul 13 17:47:00 servidor sshd[84533]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.182.74.203 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.74.203
country_id: 798544
description:
Jul 13 17:47:00 servidor sshd[84533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.74.203  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:48:32 servidor sshd[85137]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.207.200.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:48:32 servidor sshd[85137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.207.200.77


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 17:49:01 servidor sshd[85233]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 17:49:01 servidor sshd[85233]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.246.224.218  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 106.246.224.218
country_id: 1835841
description:
Jul 13 17:49:03 servidor sshd[85233]: Failed password for redestreamhost from 106.246.224.218 port 47736 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 17:50:26 servidor sshd[85790]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 17:50:26 servidor sshd[85790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:50:47 servidor sshd[85876]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.207.200.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:50:47 servidor sshd[85876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.207.200.77


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.207.200.77
country_id: 1269750
description:
Jul 13 17:50:49 servidor sshd[85876]: Failed password for invalid user user from 35.207.200.77 port 34808 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.236.46
country_id: 1643084
description:
[2025-07-13 17:53:49 -0300] info [whostmgrd] 103.65.236.46 - distakec "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 17:54:14 servidor sshd[86748]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 17:54:14 servidor sshd[86748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 17:54:43 servidor sshd[86866]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:55:01 servidor sshd[86881]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.137.34.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:55:01 servidor sshd[86881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.137.34.110


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 17:54:13 servidor sshd[86748]: Invalid user radioitaboraisantos from 193.32.162.218 port 38860


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 17:54:45 servidor sshd[86866]: Failed password for redecast from 92.118.39.34 port 59542 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.34
country_id: 6252001
description:
Jul 13 17:54:43 servidor sshd[86866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.34  user=redecast


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:55:05 servidor sshd[86881]: Disconnected from invalid user astra 113.137.34.110 port 43646 [preauth]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:55:24 servidor sshd[87100]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.137.34.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.137.34.110
country_id: 1814991
description:
Jul 13 17:55:24 servidor sshd[87100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.137.34.110


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 17:59:56 servidor sshd[88005]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.84
country_id: 6252001
description:
Jul 13 17:59:56 servidor sshd[88005]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.84  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 18:03:56 servidor sshd[90245]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:03:52 servidor sshd[90239]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.83.162.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:03:52 servidor sshd[90239]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.83.162.167  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:04:15 servidor sshd[90341]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.98.255.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 109.199.112.65
country_id: 2921044
description:
Jul 13 18:04:25 servidor sshd[90363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.199.112.65  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 58.242.187.144
country_id: 1814991
description:
Jul 13 18:04:38 servidor sshd[90399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.242.187.144  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.1.255.55
country_id: 1835841
description:
Jul 13 18:04:43 servidor sshd[90404]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.1.255.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:04:15 servidor sshd[90341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.98.255.233  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-07-13 18:04:22 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:41039: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.199.112.65
country_id: 2921044
description:
Jul 13 18:04:25 servidor sshd[90363]: pam_imunify(sshd:auth): [IM360_RBL] The IP 109.199.112.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-07-13 18:04:36 dovecot_login authenticator failed for (superviezzer.static.gvt.net.br) [177.159.99.95]:57519: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.1.255.55
country_id: 1835841
description:
Jul 13 18:04:43 servidor sshd[90404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.1.255.55


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.133.35.58
country_id: 1814991
description:
2025-07-13 18:05:09 dovecot_login authenticator failed for ([117.133.35.58]) [117.133.35.58]:48176: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.144.50
country_id: 3175395
description:
2025-07-13 18:05:27 dovecot_login authenticator failed for ([101.58.144.50]) [101.58.144.50]:35483: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:06:34 servidor sshd[91039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.81.123  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.9.170.231
country_id: 1814991
description:
Jul 13 18:06:47 servidor sshd[91069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.9.170.231  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.252.88.239
country_id: 2921044
description:
Jul 13 18:06:19 servidor sshd[91022]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.252.88.239 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.252.88.239
country_id: 2921044
description:
Jul 13 18:06:19 servidor sshd[91022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.252.88.239  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:06:34 servidor sshd[91039]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.81.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:07:32 servidor sshd[91243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.83.162.167  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:07:24 servidor sshd[91237]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.98.255.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:07:24 servidor sshd[91237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.98.255.233  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:07:32 servidor sshd[91243]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.83.162.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 58.242.187.144
country_id: 1814991
description:
Jul 13 18:07:49 servidor sshd[91290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.242.187.144  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:07:50 servidor sshd[91296]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.81.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:07:50 servidor sshd[91296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.81.123  user=root


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 18:08:03 servidor sshd[91435]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.9.170.231
country_id: 1814991
description:
Jul 13 18:08:39 servidor sshd[91525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.9.170.231  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:08:56 servidor sshd[91623]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.81.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.81.123
country_id: 2750405
description:
Jul 13 18:08:56 servidor sshd[91623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.81.123  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:08:37 servidor sshd[91521]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.98.255.233 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.98.255.233
country_id: 719819
description:
Jul 13 18:08:37 servidor sshd[91521]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.98.255.233  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:09:02 servidor sshd[91667]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.83.162.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.83.162.167
country_id: 1168579
description:
Jul 13 18:09:02 servidor sshd[91667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.83.162.167  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 58.242.187.144
country_id: 1814991
description:
Jul 13 18:09:16 servidor sshd[91786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.242.187.144  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.211.25.121
country_id: 3175395
description:
Jul 13 18:09:48 servidor sshd[91877]: pam_imunify(sshd:auth): [IM360_RBL] The IP 80.211.25.121 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 80.211.25.121
country_id: 3175395
description:
Jul 13 18:09:48 servidor sshd[91877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.25.121  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 201.69.132.236
country_id: 3469034
description:
Jul 13 18:12:02 servidor sshd[92719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.69.132.236


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.9.170.231
country_id: 1814991
description:
Jul 13 18:11:44 servidor sshd[92596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.9.170.231  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.69.132.236
country_id: 3469034
description:
Jul 13 18:12:02 servidor sshd[92719]: pam_imunify(sshd:auth): [IM360_RBL] The IP 201.69.132.236 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.69.132.236
country_id: 3469034
description:
Jul 13 18:12:04 servidor sshd[92719]: Failed password for invalid user 80907806791 from 201.69.132.236 port 33310 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.243.96.5
country_id: 690791
description:
[2025-07-13 18:13:02 -0300] info [cpaneld] 185.243.96.5 - Brandon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user Brandon (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.11.165.119
country_id: 3017382
description:
Jul 13 18:13:32 servidor sshd[93020]: pam_imunify(sshd:auth): [IM360_RBL] The IP 141.11.165.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 141.11.165.119
country_id: 3017382
description:
Jul 13 18:13:32 servidor sshd[93020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.11.165.119  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 18:13:40 servidor sshd[93054]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.36
country_id: 6252001
description:
Jul 13 18:13:40 servidor sshd[93054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.36  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 18:15:01 servidor sshd[93313]: pam_imunify(sshd:auth): [IM360_RBL] The IP 1.226.84.145 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 1.226.84.145
country_id: 1835841
description:
Jul 13 18:15:01 servidor sshd[93313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.226.84.145  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.34.212.116
country_id: 798544
description:
Jul 13 18:19:45 servidor sshd[95650]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.34.212.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.34.212.116
country_id: 798544
description:
Jul 13 18:19:45 servidor sshd[95650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.34.212.116


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 18:21:41 servidor sshd[96319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.246.3.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.3.235
country_id: 2661886
description:
Jul 13 18:21:41 servidor sshd[96319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.3.235


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 18:23:49 servidor sshd[97025]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.152
country_id: 798549
description:
Jul 13 18:23:49 servidor sshd[97025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.152  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.91.86
country_id: 3017382
description:
Jul 13 18:26:33 servidor sshd[97889]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.91.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.91.86
country_id: 3017382
description:
Jul 13 18:26:33 servidor sshd[97889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.91.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.41.244.112
country_id: 1814991
description:
2025-07-13 18:26:17 dovecot_login authenticator failed for ([117.41.244.112]) [117.41.244.112]:47388: 535 Incorrect authentication data (set_id=contato@redestreamhost.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-07-13 18:26:30 dovecot_login authenticator failed for net-93-145-118-40.cust.vodafonedsl.it [93.145.118.40]:55112: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 18:27:42 servidor sshd[98133]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.218
country_id: 798549
description:
Jul 13 18:27:42 servidor sshd[98133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.218  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 18:30:15 servidor sshd[98855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.28.61
country_id: 1562822
description:
Jul 13 18:30:15 servidor sshd[98855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.28.61  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 18:32:39 servidor sshd[100699]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 18:32:39 servidor sshd[100699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.115  user=redestreamhost


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 92.118.39.115
country_id: 6252001
description:
Jul 13 18:32:42 servidor sshd[100699]: Failed password for redestreamhost from 92.118.39.115 port 36230 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Jul 13 18:35:28 servidor sshd[101485]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.123.231
country_id: 1835841
description:
Jul 13 18:35:28 servidor sshd[101485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.123.231  user=root


plugin: ossec
rule: 5716
name: SSHD authentication failed.
abuser: 175.126.123.231
country_id: 1835841
description:
Jul 13 18:35:31 servidor sshd[101485]: Failed password for root from 175.126.123.231 port 38606 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.52.21.96
country_id: 6251999
description:
Jul 13 18:38:25 servidor sshd[102272]: pam_imunify(sshd:auth): [IM360_RBL] The IP 96.52.21.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 96.52.21.96
country_id: 6251999
description:
Jul 13 18:38:25 servidor sshd[102272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.52.21.96  user=root


